Detects when AWS Security Hub is disabled in a region via CloudTrail management-plane API calls (DisableSecurityHub). The rule matches successful DisableSecurityHub events logged under the aws.cloudtrail dataset and is intended to flag defense evasion and potential pre-ransomware activity, since disabling Security Hub halts centralized finding aggregation and may impact compliance checks (e.g., CIS, PCI DSS, AWS Foundational Security Best Practices). It leverages the CloudTrail ingestion (logs-aws.cloudtrail-*) and targets events where the provider is securityhub.amazonaws.com and the action is DisableSecurityHub. The detection maps to MITRE ATT&CK technique T1562.001 (Disable or Modify Tools) under Defense Evasion (TA0005). It requires review of the caller identity (aws.cloudtrail.user_identity.arn) and can prompt rapid remediation: re-enable Security Hub, revoke sessions, and verify related services (GuardDuty, Macie, Inspector) for continued operation. Future detections can be augmented by enforcing a guardrail to alert on any re-disabling in production accounts and validating against change-management records.