AWS GuardDuty Publishing Destination Deletion

Adversaries possessing sufficient AWS administrative privileges may target the GuardDuty configuration to impair security monitoring. Amazon GuardDuty typically exports findings to centralized storage (S3), data lakes (Security Lake), or event buses (EventBridge) for ingestion into a SIEM. By executing the DeletePublishingDestination API call, an attacker severs this telemetry pipeline.

Crucially, this technique allows the attacker to maintain the GuardDuty detector in an active state, which may prevent alerts that would otherwise trigger if the service itself were disabled. This activity is typically indicative of an attempt to perform unauthorized actions within the AWS environment while ensuring those actions are not correlated or archived for security review. Defenders should monitor for this control-plane modification, as it is highly uncommon in stable production environments.

Impact

Successful execution results in a loss of visibility into potential threats, as security findings are no longer delivered to external storage or SIEM platforms. This hampers incident response by denying defenders access to historical logs and real-time alerts, potentially allowing a compromise to persist undetected across AWS accounts.

Recommendation

• Deploy the provided detection rule to monitor for DeletePublishingDestination CloudTrail events.
• Implement Service Control Policies (SCPs) or IAM policies to restrict the guardduty:DeletePublishingDestination action to a limited set of authorized security operations roles.
• Review IAM permissions for existing identities to identify those with excessive administrative access to GuardDuty.
• Establish alerting for any changes to GuardDuty publishing destinations, prioritizing investigation of deletions that lack a documented change management ticket.