Elastic medium stable kql

AWS Route 53 Private Hosted Zone Associated With a VPC

Identifies when an AWS Route 53 private hosted zone is associated with a new Virtual Private Cloud (VPC). Private hosted zones restrict DNS resolution to specific VPCs, and associating additional VPCs expands the scope of what networks can resolve internal DNS records. Adversaries with sufficient permissions may associate unauthorized VPCs to intercept, observe, or reroute internal traffic, establish persistence, or expand their visibility within an AWS environment.

View Source

Detection Logic

data_stream.dataset: aws.cloudtrail 
    and event.provider: route53.amazonaws.com 
    and event.action: AssociateVPCWithHostedZone 
    and event.outcome: success
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

⚠ Private hosted zones may be legitimately associated with VPCs by network or infrastructure administrators. Verify whether the user identity, user agent, and source IP address align with expected administrative behavior. Known and authorized associations may be exempted to reduce noise.

Field Validations

Loading…

Comments (0)

Loading comments...