Tag
AWS Route 53 Resolver Query Log Configuration Deleted
2 rules 1 TTPDetection of the deletion of an Amazon Route 53 Resolver Query Log Configuration, potentially stopping DNS query and response logging for associated VPCs, which can be used by adversaries to evade detection and suppress forensic evidence.
AWS Route 53 Domain Transfer Lock Disabled
2 rules 3 TTPsThe disabling of the transfer lock on an AWS Route 53 domain is detected, potentially indicating unauthorized domain transfer, takeover, or service disruption by an adversary gaining domain-management permissions.
AWS Route 53 Private Hosted Zone Associated With Unauthorized VPC
2 rules 3 TTPsAn adversary with sufficient permissions may associate unauthorized VPCs to intercept, observe, or reroute internal traffic, establish persistence, or expand their visibility within an AWS environment by associating a Route 53 private hosted zone with a new Virtual Private Cloud (VPC).
AWS Route 53 Domain Transferred to Another Account
2 rules 2 TTPsAn AWS Route 53 domain was transferred to another AWS account, potentially leading to unauthorized control over DNS records and traffic redirection for malicious purposes, such as phishing or establishing persistence.