AWS Route 53 Domain Transferred to Another Account

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•4•0•26

Detects when an AWS Route 53 domain is transferred to another AWS account. This activity could indicate an attempt by an adversary to maintain persistence or exfiltrate domain control by moving it to an account they control.