AWS Organization Unit Modified for Evasion

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects when an AWS Organization Unit (OU) is modified, specifically when the 'MoveAccount' API call is made to 'organizations.amazonaws.com'. This activity could indicate an attempt to evade detection or alter the organizational structure for malicious purposes.