Elastic medium stable kql

AWS Organizations Delegated Administrator Registered

Detects when an AWS member account is registered as a delegated administrator for an AWS service via the RegisterDelegatedAdministrator API. Delegated administrators receive service-level administrative access across the entire organization without being the management account. An attacker who compromises a principal with organizations permissions can abuse overly permissive managed policies to register a member account they control as a delegated administrator, then use that privileged access to escalate privileges organization-wide and compromise all member accounts.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "organizations.amazonaws.com"
    and event.action: "RegisterDelegatedAdministrator"
    and event.outcome: "success"

False Positives

  • ⚠ Legitimate cloud platform operations — enabling Security Hub, GuardDuty, or other AWS services at the organization level — require registering a delegated administrator. Validate the called service and target account against your organization's approved delegated admin configuration and a corresponding change management record.

Field Validations

Loading…

Comments (0)

Loading comments...