AWS GuardDuty Publishing Destination Deleted

Last updated 13 days ago on 2026-08-14

Created 13 days ago on 2026-08-14

About

Detects the deletion of an Amazon GuardDuty publishing destination. Publishing destinations export GuardDuty findings to S3, Security Lake, or EventBridge for long-term retention and SIEM ingestion. An adversary with GuardDuty administrative access may delete a publishing destination to prevent findings from reaching external storage or a security operations center, reducing the visibility of their activity while leaving the GuardDuty detector active.

Tags

Domain: CloudPlatform: AWSData Source: AWS CloudTrailService: AWS GuardDutyRule Type: Custom Query (KQL)Tactic: Defense EvasionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Decommissioning of a GuardDuty publishing destination during a planned security architecture migration may trigger this rule. Validate that the deletion is associated with a known infrastructure change and that an alternative destination was configured.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeletePublishingDestination"
    and event.outcome: "success"

Install detection rules in Elastic Security

Detect AWS GuardDuty Publishing Destination Deleted in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).