AWS Organizations Delegated Administrator Registered

  1[metadata]
  2creation_date = "2026/08/24"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/24"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when an AWS member account is registered as a delegated administrator for an AWS
 11service via the RegisterDelegatedAdministrator API. Delegated administrators receive
 12service-level administrative access across the entire organization without being the
 13management account. An attacker who compromises a principal with organizations permissions
 14can abuse overly permissive managed policies to register a member account they control as
 15a delegated administrator, then use that privileged access to escalate privileges
 16organization-wide and compromise all member accounts.
 17"""
 18false_positives = [
 19    """
 20    Legitimate cloud platform operations — enabling Security Hub, GuardDuty, or other
 21    AWS services at the organization level — require registering a delegated administrator.
 22    Validate the called service and target account against your organization's approved
 23    delegated admin configuration and a corresponding change management record.
 24    """,
 25]
 26from = "now-6m"
 27index = ["logs-aws.cloudtrail-*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "AWS Organizations Delegated Administrator Registered"
 31note = """## Triage and analysis
 32
 33### Investigating AWS Organizations Delegated Administrator Registered
 34
 35AWS allows organizations to delegate service-level administrative access to a member account via RegisterDelegatedAdministrator. The delegated account gains organization-wide administrative privileges for the specified service without being the management account. Adversaries who compromise a principal in the management account with overly permissive Organizations policies can register an attacker-controlled member account as a delegated administrator, then use that foothold to escalate privileges across all accounts in the organization.
 36
 37This technique was documented by Cymulate, who found that AmazonGuardDutyFullAccess v1 (before AWS corrected it) granted organizations:RegisterDelegatedAdministrator without resource restrictions, allowing any principal with that policy to elevate a member account to organization-wide admin for sensitive services such as Identity Center or CloudFormation StackSets.
 38
 39### Possible investigation steps
 40
 41- Identify the caller in aws.cloudtrail.user_identity.arn and user.name. Verify they are an authorized cloud platform administrator.
 42- Review aws.cloudtrail.request_parameters for the servicePrincipal (which AWS service was delegated) and accountId (which member account was elevated). Confirm the member account belongs to your organization's account inventory.
 43- Determine whether this delegation was planned. Compare against your organization's current delegated administrator configuration via organizations:ListDelegatedAdministrators.
 44- Check whether the newly elevated member account subsequently made cross-account API calls or modified permission sets, IAM roles, or CloudFormation stacks.
 45- Review which managed policies are attached to the calling principal. Policies with broad organizations:* grants without resource restrictions may be exploited for this technique.
 46
 47### Response and remediation
 48
 49- If unauthorized, deregister the delegated administrator with organizations:DeregisterDelegatedAdministrator.
 50- Revoke active sessions for the calling identity and audit all management account activity.
 51- Review and tighten IAM policies attached to principals in the management account — ensure organizations:RegisterDelegatedAdministrator is restricted to a dedicated, MFA-required role.
 52- Enumerate all delegated administrators in the organization to identify any additional unauthorized delegations.
 53"""
 54references = [
 55    "https://docs.aws.amazon.com/organizations/latest/APIReference/API_RegisterDelegatedAdministrator.html",
 56    "https://cymulate.com/blog/aws-delegated-admin-org-takeover/",
 57]
 58risk_score = 47
 59rule_id = "ad8ca41c-8e3d-49cd-b130-42af09d1eb42"
 60setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. Organizations management events are logged in the organization management account by default."
 61severity = "medium"
 62tags = [
 63    "Domain: Cloud",
 64    "Platform: AWS",
 65    "Data Source: AWS CloudTrail",
 66    "Service: AWS Organizations",
 67    "Rule Type: Custom Query (KQL)",
 68    "Tactic: Persistence",
 69    "Tactic: Privilege Escalation",
 70    "Resources: Investigation Guide",
 71]
 72timestamp_override = "event.ingested"
 73type = "query"
 74
 75query = '''
 76data_stream.dataset: "aws.cloudtrail"
 77    and event.provider: "organizations.amazonaws.com"
 78    and event.action: "RegisterDelegatedAdministrator"
 79    and event.outcome: "success"
 80'''
 81
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85[[rule.threat.technique]]
 86id = "T1098"
 87name = "Account Manipulation"
 88reference = "https://attack.mitre.org/techniques/T1098/"
 89[[rule.threat.technique.subtechnique]]
 90id = "T1098.003"
 91name = "Additional Cloud Roles"
 92reference = "https://attack.mitre.org/techniques/T1098/003/"
 93
 94
 95[rule.threat.tactic]
 96id = "TA0003"
 97name = "Persistence"
 98reference = "https://attack.mitre.org/tactics/TA0003/"
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101[[rule.threat.technique]]
102id = "T1484"
103name = "Domain or Tenant Policy Modification"
104reference = "https://attack.mitre.org/techniques/T1484/"
105
106
107[rule.threat.tactic]
108id = "TA0004"
109name = "Privilege Escalation"
110reference = "https://attack.mitre.org/tactics/TA0004/"
111
112[rule.investigation_fields]
113field_names = [
114    "@timestamp",
115    "aws.cloudtrail.user_identity.arn",
116    "aws.cloudtrail.user_identity.type",
117    "aws.cloudtrail.user_identity.access_key_id",
118    "user.name",
119    "event.action",
120    "event.outcome",
121    "aws.cloudtrail.request_parameters",
122    "source.ip",
123    "cloud.account.id",
124]