Query: alert when Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection
Matching passage: Sigma rule: Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection. Logsource: aws / cloudtrail. Rule: title: AWS GuardDuty Detector Deleted Or Updated id: d2656e78-c069-4571-8220-9e0ab5913f19 status: experimental description: 'Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate. ' references: - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/ - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml - https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/ - https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/ - https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion author: suktech24 date: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection_event_source: eventSource: guardduty.amazonaws.com selection_action_delete: eventName: DeleteDetector selection_action_update: eventName: UpdateDetector requestParameters.enable: 'false' selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_* falsepositives: - Legitimate detector deletion by an admin (e.g., during account decommissioning). - Temporary disablement for troubleshooting (verify via change management tickets). - Automated deployment tools (e.g. Terraform) managing GuardDuty state. level: high
Near-miss passage: Sigma rule: Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading c. Logsource: windows / process_creation. Rule: title: HackTool - Doppelanger LSASS Dumper Execution id: d474c8fe-bb69-4ea0-b7d9-f682b56d52d3 status: experimental description: Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods references: - https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/ - https://github.com/vari-sh/RedTeamGrimoire/tree/668e0357072546065729ad623f8c02f7be21bb08/Doppelganger author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-01 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \Doppelganger.exe - Hashes|contains: - IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB - IMPHASH=65F0EA61156EE0C2A35421926F0C7F78 condition: selection falsepositives: - Unknown level: high