AWS Attempt to Leave Organization

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects any attempt, successful or denied, for a member account to leave an AWS Organization via the LeaveOrganization
 11API. Leaving an organization immediately strips the account of every Service Control Policy (SCP) guardrail the
 12organization enforces, removes it from centralized CloudTrail aggregation, and eliminates the management account's
 13ability to audit or control it going forward. An adversary who has gained root or organization-management-capable access
 14in a member account may use this technique to escape organizational security controls and operate unmonitored. Denied
 15attempts are included because a blocked call is just as strong a signal of intent as a successful one, and is often the
 16only trace left when the account's default permissions correctly prevent the action.
 17"""
 18false_positives = [
 19    """
 20    Accounts may legitimately leave an organization during company splits, divestitures, or other structural changes.
 21    This action requires the account's root credentials or an explicit policy granting
 22    `organizations:LeaveOrganization`. Any unexpected event, successful or denied, should be treated as a critical
 23    incident requiring immediate investigation and confirmation with account/organization owners.
 24    """,
 25]
 26from = "now-6m"
 27index = ["logs-aws.cloudtrail-*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "AWS Attempt to Leave Organization"
 31note = """## Triage and analysis
 32
 33### Investigating AWS Attempt to Leave Organization
 34
 35Leaving an AWS Organization removes every SCP-based guardrail from the account, cuts it off from centralized
 36monitoring (CloudTrail, GuardDuty, Security Hub aggregation at the organization level), and eliminates the management
 37account's ability to audit or control it. This is one of the most consequential defense-evasion actions available to
 38an adversary with sufficient access in a member account.
 39
 40This rule fires on any `LeaveOrganization` call regardless of outcome — a denied attempt (for example, `AccessDenied`
 41because the calling principal lacks the permission) is still a critical indicator that someone attempted this action.
 42
 43### Possible investigation steps
 44
 45- **Identify the actor**: review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` —
 46  only root or a principal with an explicit `organizations:LeaveOrganization` grant can succeed at this.
 47- **Check the outcome**: if `event.outcome` is `success`, treat this as an active, ongoing incident — the account has
 48  already left the organization. If denied, determine why the attempt was made and whether the same actor has
 49  broader access that could be escalated to succeed.
 50- **Review source context**: check `source.ip`, `user_agent.original`, and `source.geo` for anomalies.
 51- **Correlate with other defense evasion or persistence activity**: look for recent IAM changes (new roles, policy
 52  attachments), root login events, or other attempts to shed organizational oversight around the same time.
 53- **Contact the account and organization owners immediately** to confirm whether this was an authorized, planned
 54  departure.
 55
 56### False positive analysis
 57
 58- Legitimate organizational restructuring (account divestiture, company split) can trigger this. Confirm with
 59  organization administrators and require documented change management before treating as benign.
 60
 61### Response and remediation
 62
 63- If successful and unauthorized, use `InviteAccountToOrganization` from the management account to re-invite the
 64  departed account as soon as possible, and treat the account as compromised in the interim.
 65- If denied, investigate how the calling principal obtained enough access to attempt this at all, and whether it can
 66  reach the required permission through another path (privilege escalation).
 67- Revoke or rotate credentials for the identity that made the call.
 68- Review the account's activity for the period immediately before and after the attempt for other compromise
 69  indicators.
 70
 71"""
 72references = [
 73    "https://docs.aws.amazon.com/organizations/latest/APIReference/API_LeaveOrganization.html",
 74    "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_remove.html",
 75    "https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.organizations-leave/",
 76]
 77risk_score = 47
 78rule_id = "4236393d-090e-4dfa-9e32-c9a7ec6189ee"
 79severity = "medium"
 80tags = [
 81    "Domain: Cloud",
 82    "Data Source: AWS",
 83    "Data Source: Amazon Web Services",
 84    "Data Source: AWS CloudTrail",
 85    "Data Source: AWS Organizations",
 86    "Use Case: Threat Detection",
 87    "Tactic: Defense Evasion",
 88    "Tactic: Impact",
 89    "Resources: Investigation Guide",
 90]
 91timestamp_override = "event.ingested"
 92type = "query"
 93
 94query = '''
 95data_stream.dataset: "aws.cloudtrail"
 96    and event.provider: "organizations.amazonaws.com"
 97    and event.action: "LeaveOrganization"
 98'''
 99
100
101[[rule.threat]]
102framework = "MITRE ATT&CK"
103[[rule.threat.technique]]
104id = "T1562"
105name = "Impair Defenses"
106reference = "https://attack.mitre.org/techniques/T1562/"
107[[rule.threat.technique.subtechnique]]
108id = "T1562.001"
109name = "Disable or Modify Tools"
110reference = "https://attack.mitre.org/techniques/T1562/001/"
111
112
113
114[rule.threat.tactic]
115id = "TA0005"
116name = "Defense Evasion"
117reference = "https://attack.mitre.org/tactics/TA0005/"
118[[rule.threat]]
119framework = "MITRE ATT&CK"
120[[rule.threat.technique]]
121id = "T1531"
122name = "Account Access Removal"
123reference = "https://attack.mitre.org/techniques/T1531/"
124
125
126[rule.threat.tactic]
127id = "TA0040"
128name = "Impact"
129reference = "https://attack.mitre.org/tactics/TA0040/"
130
131[rule.investigation_fields]
132field_names = [
133    "@timestamp",
134    "user.name",
135    "user_agent.original",
136    "source.ip",
137    "aws.cloudtrail.user_identity.arn",
138    "aws.cloudtrail.user_identity.type",
139    "aws.cloudtrail.user_identity.access_key_id",
140    "event.provider",
141    "event.action",
142    "event.outcome",
143    "aws.cloudtrail.error_code",
144    "aws.cloudtrail.error_message",
145    "cloud.account.id",
146    "cloud.region",
147]