AWS Route 53 Domain Transfer Lock Disabled
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Sigma rule (View on GitHub)
1title: AWS Route 53 Domain Transfer Lock Disabled
2id: 3940b5f1-3f46-44aa-b746-ebe615b879e0
3status: test
4description: Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
5references:
6 - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml
7 - https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html
8 - https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html
9author: Elastic, Austin Songer @austinsonger
10date: 2021-07-22
11modified: 2022-10-09
12tags:
13 - attack.persistence
14 - attack.credential-access
15 - attack.t1098
16logsource:
17 product: aws
18 service: cloudtrail
19detection:
20 selection:
21 eventSource: route53.amazonaws.com
22 eventName: DisableDomainTransferLock
23 condition: selection
24falsepositives:
25 - A domain transfer lock may be disabled by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Activity from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
26level: low
References
-
-
-
This operation removes the transfer lock on the domain (specifically the clientTransferProhibited status) to allow domain transfers. We recommend you refrain from performing this action unless you intend to transfer the domain to a different registrar. Successful submission returns an operation ID that you can use to track the progress and completion of the action. If the request is not completed successfully, the domain registrant will be notified by email.
Read More
Related rules
- AWS Route 53 Domain Transferred to Another Account
- Change to Authentication Method
- A Member Was Added to a Security-Enabled Global Group
- A Member Was Removed From a Security-Enabled Global Group
- A New Trust Was Created To A Domain