LoFP / legitimate cloud platform operations — enabling security hub, guardduty, or other aws services at the organization level — require registering a delegated administrator. validate the called service and target account against your organization's approved delegated admin configuration and a corresponding change management record.

Techniques

• T1098
• T1484

Sample rules

AWS Organizations Delegated Administrator Registered

• source: elastic
• technicques:
  • T1098
  • T1484

Description

Detects when an AWS member account is registered as a delegated administrator for an AWS service via the RegisterDelegatedAdministrator API. Delegated administrators receive service-level administrative access across the entire organization without being the management account. An attacker who compromises a principal with organizations permissions can abuse overly permissive managed policies to register a member account they control as a delegated administrator, then use that privileged access to escalate privileges organization-wide and compromise all member accounts.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "organizations.amazonaws.com"
    and event.action: "RegisterDelegatedAdministrator"
    and event.outcome: "success"