Product
AWS Security Services Impairment via Deletion of Resources
2 rules 1 TTPDetection of adversaries attempting to impair or disable AWS security services by deleting resources across GuardDuty, AWS WAF, CloudWatch, Route 53, and CloudWatch Logs to evade detection and remove visibility.
AWS Route 53 Domain Transfer Lock Disabled
2 rules 3 TTPsThe disabling of the transfer lock on an AWS Route 53 domain is detected, potentially indicating unauthorized domain transfer, takeover, or service disruption by an adversary gaining domain-management permissions.
AWS Route 53 Private Hosted Zone Associated With Unauthorized VPC
2 rules 3 TTPsAn adversary with sufficient permissions may associate unauthorized VPCs to intercept, observe, or reroute internal traffic, establish persistence, or expand their visibility within an AWS environment by associating a Route 53 private hosted zone with a new Virtual Private Cloud (VPC).
AWS Route 53 Domain Transferred to Another Account
2 rules 2 TTPsAn AWS Route 53 domain was transferred to another AWS account, potentially leading to unauthorized control over DNS records and traffic redirection for malicious purposes, such as phishing or establishing persistence.