Possible Disabling of AWS Route 53 Domain Transfer Lock (via cloudtrail)

title: Possible Disabling of AWS Route 53 Domain Transfer Lock (via cloudtrail)
id: 9532279d-032e-53e4-b8ca-dc8f755ffd89
status: stable
description: This rule detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
references:
    - https://attack.mitre.org/techniques/T1098/
    - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml
    - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html
    - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html
author: Huntrule Team
date: 2026-02-16
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.credential-access
    - attack.t1098
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: route53.amazonaws.com
        eventName: DisableDomainTransferLock
    condition: selection
falsepositives:
    - Unknown
level: low