AWS CloudTrail: Route 53 Domain Transferred to Another AWS Account

title: "AWS CloudTrail: Route 53 Domain Transferred to Another AWS Account"
id: 8ca136a2-0d8a-40c0-8a2b-2583692a2e42
status: test
description: This rule flags CloudTrail events where an AWS Route 53 domain is transferred to another AWS account via the Route 53 API. Domain transfers can be used to move DNS control and disrupt services or facilitate follow-on access. It relies on Route 53 CloudTrail telemetry matching the Route 53 event source and the TransferDomainToAnotherAwsAccount event name.
references:
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml
author: Elastic, Austin Songer @austinsonger, Huntrule Team
date: 2021-07-22
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.credential-access
  - attack.privilege-escalation
  - attack.t1098
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: route53.amazonaws.com
    eventName: TransferDomainToAnotherAwsAccount
  condition: selection
falsepositives:
  - A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: b056de1a-6e6e-4e40-a67e-97c9808cf41b
    type: derived