This rule detects the deletion of an AWS GuardDuty publishing destination, which would stop forwarding GuardDuty findings to external storage or SIEM pipelines (such as S3 buckets, Security Lake, or EventBridge). Deleting a publishing destination leaves findings visible in the GuardDuty console but eliminates export, reducing security operations visibility and correlation with other events. The detection relies on CloudTrail data (aws.cloudtrail) and filters for GuardDuty management activity with the action DeletePublishingDestination and a successful outcome. Key fields used for investigation include aws.cloudtrail.user_identity.arn, user.name, aws.cloudtrail.request_parameters (destination ID and detector ID), source IP, region, and cloud.account.id. The event is associated with Defense Evasion (MITRE ATT&CK T1562.001, Disable or Modify Tools) as an attacker technique. This action is uncommon in production unless part of a planned migration or decommissioning; mismatched or unauthorized deletions should be investigated promptly. Recommended triage includes verifying the caller’s identity and rationale, checking for other GuardDuty control-plane actions by the same identity, and confirming whether a replacement destination exists. Remediation involves re-creating the publishing destination if the deletion was unauthorized, rotating credentials for the caller, and applying least-privilege controls to restrict DeletePublishingDestination to a dedicated security role. Cross-account checks should ensure the action wasn’t replicated across multiple accounts.