Elastic high stable kql

AWS Route 53 Domain Transferred to Another Account

Identifies when an AWS Route 53 domain is transferred to another AWS account. Transferring a domain changes administrative control of the DNS namespace, enabling the receiving account to modify DNS records, route traffic, request certificates, and potentially hijack operational workloads. Adversaries who gain access to privileged IAM users or long-lived credentials may leverage domain transfers to establish persistence, redirect traffic, conduct phishing, or stage infrastructure for broader attacks. This rule detects successful domain transfer requests.

View Source

Detection Logic

data_stream.dataset: aws.cloudtrail 
    and event.provider: route53domains.amazonaws.com 
    and event.action: TransferDomainToAnotherAwsAccount 
    and event.outcome: success

False Positives

⚠ Internal account restructuring, mergers and acquisitions, or legitimate ownership transfers between business units may involve transferring DNS domains to other AWS accounts. Confirm the transfer is approved and documented in change management processes before taking action. Transfers performed by unfamiliar identities, originating from atypical locations, or outside expected maintenance windows should be investigated.

Field Validations

Loading…

Comments (0)

Loading comments...