AWS Security Hub Disabled

Last updated a month ago on 2026-09-18

Created 2 months ago on 2026-08-24

About

Detects when AWS Security Hub is disabled in a region. Security Hub aggregates security findings from AWS services (GuardDuty, Inspector, Macie, IAM Access Analyzer) and third-party tools into a single pane of glass. Disabling it suppresses centralized finding aggregation and compliance checks, removing visibility into threats across the account. This action is a documented pre-ransomware and pre-exfiltration defense evasion technique.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesPlatform: AWSData Source: AWS CloudTrailService: AWS Security HubRule Type: Custom Query (KQL)Tactic: Defense EvasionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Legitimate account decommissioning or cost-reduction exercises may disable Security Hub in unused regions. Validate with the responsible team via change management records before escalating. Disabling in the primary account region or the Security Hub delegated administrator account is always high-risk.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "securityhub.amazonaws.com"
    and event.action: "DisableSecurityHub"
    and event.outcome: "success"

Install detection rules in Elastic Security

Detect AWS Security Hub Disabled in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).