AWS GuardDuty Publishing Destination Deleted
This rule detects when a GuardDuty Detector's publishing destination has been deleted. GuardDuty is an AWS threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect AWS accounts and workloads. Deleting its publishing destination prevents GuardDuty from exporting its findings, effectively impairing the organization's ability to detect and respond to security incidents. This action could be performed by an attacker attempting to hide their activities or by an insider aiming to reduce security visibility.
YARA-L
