AWS Account Closed

  1[metadata]
  2creation_date = "2026/07/13"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/13"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the closure of an AWS account via the CloseAccount API. This can be called either by the account itself
 11(account.amazonaws.com, self-service closure) or by an AWS Organizations management account against one of its member
 12accounts (organizations.amazonaws.com). Account closure triggers a 90-day grace period during which the account is
 13suspended before permanent termination, and is one of the most destructive and disruptive actions available in AWS. It
 14removes access to all resources and data in the account for the duration of the suspension. An adversary with root-level
 15access in a member account, or management-level access to an organization, may close accounts to destroy evidence,
 16disrupt business operations, or eliminate compute and data resources. A malicious insider could use the same action for
 17sabotage.
 18"""
 19false_positives = [
 20    """
 21    AWS accounts may be legitimately closed as part of organizational restructuring, account consolidation, or
 22    decommissioning of workloads. Legitimate closures should always have a corresponding change-management record and
 23    documented approval; any closure without one should be treated as a critical incident.
 24    """,
 25]
 26from = "now-6m"
 27index = ["logs-aws.cloudtrail-*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "AWS Account Closed"
 31note = """## Triage and analysis
 32
 33### Investigating AWS Account Closed
 34
 35AWS account closure is one of the most destructive actions that can be performed against an AWS account. Even during
 36the 90-day suspension/grace period before permanent termination, the account and its resources are inaccessible. This
 37action requires either root credentials on the account itself, or organization-management-level permissions to close
 38a member account, making any unauthorized occurrence a critical security incident.
 39
 40This rule covers both closure paths: self-service closure (`event.provider: account.amazonaws.com`) and closure of a
 41member account initiated from the organization's management account (`event.provider: organizations.amazonaws.com`).
 42
 43#### Possible investigation steps
 44
 45- **Identify the actor**: review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type` to
 46  determine who initiated the closure, and from which account context (the closed account itself, or the
 47  organization's management account).
 48- **Determine which account was closed**: check `cloud.account.id` and `aws.cloudtrail.request_parameters` (the
 49  organization-initiated path includes the target `AccountId`).
 50- **Contact the account/organization owner immediately** to confirm intent — this should never be a surprise.
 51- **Act within the grace period**: AWS Organizations can cancel a pending closure during the up-to-90-day suspension
 52  window if the action was unauthorized.
 53- **Review the actor's other activity** immediately before and after the closure for signs of broader compromise
 54  (credential creation, privilege escalation, log tampering).
 55
 56### False positive analysis
 57
 58- Legitimate account decommissioning or consolidation will show the same event. Confirm against change-management
 59  records and organizational restructuring plans before escalating further.
 60
 61### Response and remediation
 62
 63- Contact AWS Support immediately to attempt cancellation/restoration within the grace period.
 64- Revoke or rotate credentials for the identity that initiated the closure, and escalate to incident response.
 65- Preserve all available CloudTrail logs and evidence from the affected account before access is lost.
 66- Review organization-level permissions to ensure `organizations:CloseAccount` and `account:CloseAccount` are
 67  restricted to a small, trusted set of administrative identities.
 68
 69"""
 70references = [
 71    "https://docs.aws.amazon.com/accounts/latest/reference/API_CloseAccount.html",
 72    "https://docs.aws.amazon.com/organizations/latest/APIReference/API_CloseAccount.html",
 73    "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_close.html",
 74]
 75risk_score = 47
 76rule_id = "c45844ce-5e16-497d-88a6-e4bbc66133ce"
 77severity = "medium"
 78tags = [
 79    "Domain: Cloud",
 80    "Data Source: AWS",
 81    "Data Source: Amazon Web Services",
 82    "Data Source: AWS CloudTrail",
 83    "Use Case: Threat Detection",
 84    "Tactic: Impact",
 85    "Resources: Investigation Guide",
 86]
 87timestamp_override = "event.ingested"
 88type = "query"
 89
 90query = '''
 91data_stream.dataset: "aws.cloudtrail"
 92    and event.action: "CloseAccount"
 93    and event.outcome: "success"
 94    and event.provider: ("account.amazonaws.com" or "organizations.amazonaws.com")
 95'''
 96
 97
 98[[rule.threat]]
 99framework = "MITRE ATT&CK"
100[[rule.threat.technique]]
101id = "T1485"
102name = "Data Destruction"
103reference = "https://attack.mitre.org/techniques/T1485/"
104
105[[rule.threat.technique]]
106id = "T1531"
107name = "Account Access Removal"
108reference = "https://attack.mitre.org/techniques/T1531/"
109
110[rule.threat.tactic]
111id = "TA0040"
112name = "Impact"
113reference = "https://attack.mitre.org/tactics/TA0040/"
114
115[rule.investigation_fields]
116field_names = [
117    "@timestamp",
118    "user.name",
119    "user_agent.original",
120    "source.ip",
121    "aws.cloudtrail.user_identity.arn",
122    "aws.cloudtrail.user_identity.type",
123    "event.provider",
124    "event.action",
125    "event.outcome",
126    "aws.cloudtrail.request_parameters",
127    "cloud.account.id",
128    "cloud.region",
129]