AWS GuardDuty Threat Intelligence Set Deleted

Last updated 13 days ago on 2026-08-14

Created 13 days ago on 2026-08-14

About

Detects the deletion of an Amazon GuardDuty threat intelligence set. Threat intelligence sets are custom lists of known-malicious IP addresses or domains that GuardDuty uses to generate findings when monitored resources communicate with those indicators. Deleting a threat intel set degrades GuardDuty's detection capability for known adversary infrastructure, allowing communication with threat-actor-controlled IP ranges to go undetected.

Tags

Domain: CloudPlatform: AWSData Source: AWS CloudTrailService: AWS GuardDutyRule Type: Custom Query (KQL)Tactic: Defense EvasionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Removal of an outdated or inaccurate threat intelligence set during a scheduled feed rotation may trigger this rule. Confirm the deletion corresponds to a planned feed update and that a replacement set was activated.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeleteThreatIntelSet"
    and event.outcome: "success"

Install detection rules in Elastic Security

Detect AWS GuardDuty Threat Intelligence Set Deleted in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).