Rule Info
Name
AWS GuardDuty Detector Deleted Or Updated
Author
suktech24
Description
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Date
2025-11-27 00:00:00
Modified
None
Id
d2656e78-c069-4571-8220-9e0ab5913f19
Tags
attack.defense-impairment attack.t1685 attack.t1685.002
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR