LoFP / accounts may legitimately leave an organization during company splits, divestitures, or other structural changes. this action requires the account's root credentials or an explicit policy granting `organizations:leaveorganization`. any unexpected event, successful or denied, should be treated as a critical incident requiring immediate investigation and confirmation with account/organization owners.

Techniques

• T1531
• T1562

Sample rules

AWS Attempt to Leave Organization

• source: elastic
• technicques:
  • T1531
  • T1562

Description

Detects any attempt, successful or denied, for a member account to leave an AWS Organization via the LeaveOrganization API. Leaving an organization immediately strips the account of every Service Control Policy (SCP) guardrail the organization enforces, removes it from centralized CloudTrail aggregation, and eliminates the management account’s ability to audit or control it going forward. An adversary who has gained root or organization-management-capable access in a member account may use this technique to escape organizational security controls and operate unmonitored. Denied attempts are included because a blocked call is just as strong a signal of intent as a successful one, and is often the only trace left when the account’s default permissions correctly prevent the action.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "organizations.amazonaws.com"
    and event.action: "LeaveOrganization"