Skip to content

[Rule Tunings] AWS Route 53 Rules #5448

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
imays11 merged 2 commits into from
Dec 18, 2025
Merged

[Rule Tunings] AWS Route 53 Rules #5448

imays11 merged 2 commits into from
Dec 18, 2025

Conversation

@imays11
Copy link
Contributor

@imays11 imays11 commented Dec 10, 2025

Pull Request

Issue link(s):

Summary - What I changed

AWS Route53 Domain Transfer Lock Disabled and AWS Route53 Domain Transferred to Another Account were not alertingas expected due to an error in the event.provider field: (route53.amazonaws.com vs route53domains.amazonaws.com). This has been adjusted and I updated the rules in our stack in order to fully test them. I will continue to monitor these rules in telemetry moving forward to see how they perform as we currently have no existing data for them due to this error.

AWS Route53 Private Hosted Zone Associated With a VPC and AWS Route53 Resolver Query Log Configuration Deleted are performing well in telemetry, low volume as expected.

Screenshot 2025-12-10 at 12 33 14 PM

AWS Route53 Domain Transfer Lock Disabled

  • increased rule severity to high (this is a rare and high severity activity if unauthorized)
  • corrected event.provider value in query
  • updated title
  • updated Description, FP and IG sections
  • reduced execution window
  • added highlighted fields
  • updated Mitre
Screenshot 2025-12-10 at 12 41 49 PM

AWS Route53 Domain Transferred to Another Account

  • increased rule severity to high (this is a rare and high severity activity if unauthorized)
  • corrected event.provider value in query
  • updated title
  • updated Description, FP and IG sections
  • reduced execution window
  • added highlighted fields
  • updated Mitre
Screenshot 2025-12-10 at 12 43 16 PM

AWS Route53 Private Hosted Zone Associated With a VPC

  • increased rule severity to medium
  • corrected event.provider value in query
  • updated title
  • updated Description, FP and IG sections
  • reduced execution window
  • added highlighted fields
  • updated Mitre
Screenshot 2025-12-10 at 12 30 16 PM

AWS Route53 Resolver Query Log Configuration Deleted

  • updated title
  • updated Description, FP and IG sections
  • reduced execution window
  • updated tags
  • added highlighted fields
Screenshot 2025-12-10 at 12 31 46 PM

How To Test

  • Domain Transfer rules: AWS Route53 Domain Transfer Lock Disabled, AWS Route53 Domain Transferred to Another Account : trigger_persistence_route53_domain_transfer_rules.py
    • Note : This script will successfully disable Domain Transfer Lock and attempt to Transfer the Domain to an external Account. I created a new Domain, but was unable to successfully test the Domain Transfer event because new Domains in AWS are not eligible for transfer within the first 60 days of creation. Instead I adjusted the existing rule in the stack to alert for failed attempts as well, so I was still able to test the rest of the rule logic using this same script.

These scripts will trigger the other 2 rules as expected

Test data is in the stack for running the queries against.

@imays11
[Rule Tunings] AWS Route53 Rules
e952ff9 
AWS Route53 Resolver Query Log Configuration Deleted
- updated title
- updated Description, FP and IG sections
- reduced execution window
- updated tags
- added highlighted fields

AWS Route53 Domain Transfer Lock Disabled
- increased rule severity to high
- corrected `event.provider` value in query
- updated title
- updated Description, FP and IG sections
- reduced execution window
- added highlighted fields
- updated Mitre

AWS Route53 Domain Transferred to Another Account
- increased rule severity to high
- corrected `event.provider` value in query
- updated title
- updated Description, FP and IG sections
- reduced execution window
- added highlighted fields
- updated Mitre

AWS Route53 Private Hosted Zone Associated With a VPC
- increased rule severity to medium
- corrected `event.provider` value in query
- updated title
- updated Description, FP and IG sections
- reduced execution window
- added highlighted fields
- updated Mitre
@imays11 imays11 self-assigned this Dec 10, 2025
@imays11 imays11 added Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE Domain: Cloud labels Dec 10, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 10, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

@imays11 imays11 changed the title [Rule Tunings] AWS Route53 Rules [Rule Tunings] AWS Route 53 Rules Dec 10, 2025
Mikaayenson
Mikaayenson reviewed Dec 18, 2025
View reviewed changes
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One thought: shifting low --> high with functionally only the lookback changed, does that make sense? Maybe medium? Your data provided looks like this should be rare, but just double checking.

@imays11
Copy link
Contributor Author

imays11 commented Dec 18, 2025

One thought: shifting low --> high with functionally only the lookback changed, does that make sense? Maybe medium? Your data provided looks like this should be rare, but just double checking.

@Mikaayenson I didn't change the severity based on my tuning, I changed it based on the behavior itself. Transferring a domain to another account is rare and should have always been higher severity.

@imays11 imays11 merged commit c35a580 into main Dec 18, 2025
13 checks passed
@imays11 imays11 deleted the tune_aws_route53_rules branch December 18, 2025 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Aegrah Aegrah Awaiting requested review from Aegrah

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

Assignees

@imays11 imays11

Labels

backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@imays11 @Mikaayenson @terrancedejesus