Product
Detection of AWS Route 53 Resolver Query Log Deletion
2 rules 3 TTPsAdversaries may delete Amazon Route 53 Resolver Query Log configurations to evade detection by disabling DNS query and response logging for VPC-based resources.
Detection of Unauthorized AWS Route 53 Private Hosted Zone Associations
1 rule 3 TTPsAdversaries with high-level IAM permissions may associate unauthorized VPCs with AWS Route 53 private hosted zones to intercept internal DNS traffic, establish persistence, or perform reconnaissance.
AWS Security Services Impairment via Deletion of Resources
2 rules 1 TTPDetection of adversaries attempting to impair or disable AWS security services by deleting resources across GuardDuty, AWS WAF, CloudWatch, Route 53, and CloudWatch Logs to evade detection and remove visibility.
AWS Route 53 Domain Transfer Lock Disabled
2 rules 3 TTPsThe disabling of the transfer lock on an AWS Route 53 domain is detected, potentially indicating unauthorized domain transfer, takeover, or service disruption by an adversary gaining domain-management permissions.
AWS Route 53 Private Hosted Zone Associated With Unauthorized VPC
2 rules 3 TTPsAn adversary with sufficient permissions may associate unauthorized VPCs to intercept, observe, or reroute internal traffic, establish persistence, or expand their visibility within an AWS environment by associating a Route 53 private hosted zone with a new Virtual Private Cloud (VPC).
AWS Route 53 Domain Transferred to Another Account
2 rules 2 TTPsAn AWS Route 53 domain was transferred to another AWS account, potentially leading to unauthorized control over DNS records and traffic redirection for malicious purposes, such as phishing or establishing persistence.