AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount
Alerts on Route 53 domain transfer requests in CloudTrail when a domain is moved to another AWS account.
- Product
- aws
- Service
- cloudtrail
- Author
- Elastic, Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-07-22
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies CloudTrail events where a Route 53 domain is requested for transfer to another AWS account using the TransferDomainToAnotherAwsAccount action. Such transfers can indicate account-to-account domain takeover attempts or unauthorized privilege changes, making it important to review who initiated the request. The detection relies on AWS CloudTrail telemetry with matching eventSource route53.amazonaws.com and eventName TransferDomainToAnotherAwsAccount.
Reporting behind it
- github.comhttps://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS Route 53 Domain Transfer to Another Account via TransferDomainToAnotherAwsAccount
id: 8ca136a2-0d8a-40c0-8a2b-2583692a2e42
status: test
description: This rule identifies CloudTrail events where a Route 53 domain is requested for transfer to another AWS account using the TransferDomainToAnotherAwsAccount action. Such transfers can indicate account-to-account domain takeover attempts or unauthorized privilege changes, making it important to review who initiated the request. The detection relies on AWS CloudTrail telemetry with matching eventSource route53.amazonaws.com and eventName TransferDomainToAnotherAwsAccount.
references:
- https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml
author: Elastic, Austin Songer @austinsonger, Huntrule Team
date: 2021-07-22
modified: 2022-10-09
tags:
- attack.persistence
- attack.credential-access
- attack.privilege-escalation
- attack.t1098
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: route53.amazonaws.com
eventName: TransferDomainToAnotherAwsAccount
condition: selection
falsepositives:
- A domain may be transferred to another AWS account by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Domain transfers from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
- id: b056de1a-6e6e-4e40-a67e-97c9808cf41b
type: derived