AWS Account Management

eventName	Description	Sample	Rule
any	Catch-all entry for AWS Account Management rules that match the service but not a specific eventName.	N	N
DisableRegion	Disables an AWS Region for the specified account, preventing use of services and resources in that Region.	Y	Y
EnableRegion	Enables an AWS Region that was previously disabled for the account, allowing the account to use services in that Region.	N	Y
AcceptPrimaryEmailUpdate	Accepts the request that originated from StartPrimaryEmailUpdate to update the primary email address (also known as the root user email address) for the specified account.	N	N
DeleteAlternateContact	Deletes the specified alternate contact from an Amazon Web Services account.	Y	N
GetAccountInformation	Retrieves information about the specified account including its account name, account ID, account creation date and time, and account state.	Y	N
GetAlternateContact	Retrieves the specified alternate contact attached to an Amazon Web Services account.	Y	Y
GetContactInformation	Retrieves the primary contact information of an Amazon Web Services account.	Y	Y
GetGovCloudAccountInformation	Retrieves information about the GovCloud account linked to the specified standard account (if it exists) including the GovCloud account ID and state.	Y	N
GetPrimaryEmail	Retrieves the primary email address for the specified account.	Y	N
GetRegionOptStatus	Retrieves the opt-in status of a particular Region.	Y	N
ListRegions	Lists all the Regions for a given account and their respective opt-in statuses.	Y	N
PutAccountName	Updates the account name of the specified account.	N	N
PutAlternateContact	Modifies the specified alternate contact attached to an Amazon Web Services account.	N	Y
PutContactInformation	Updates the primary contact information of an Amazon Web Services account.	N	Y
StartPrimaryEmailUpdate	Starts the process to update the primary email address for the specified account.	N	N
GetPrimaryEmailUpdateStatus	Retrieves the status of the most recent primary email update for the specified account.	N	N

any: AWS Account Management (catch-all)

Service: account

Description

Catch-all entry for AWS Account Management rules that match the service but not a specific eventName.

DisableRegion

Service: account

Description

Disables an AWS Region for the specified account, preventing use of services and resources in that Region.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "ValidationException",
  "eventCategory": "Management",
  "eventID": "3a4e8a7d-c409-4242-8434-eb11f062e3f6",
  "eventName": "DisableRegion",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a17cda1d-9a2f-4e35-abf3-0debdd7b410c",
  "requestParameters": {
    "RegionName": "ddddd"
  },
  "responseElements": {
    "fieldList": [
      {
        "message": "***",
        "name": "RegionName"
      }
    ],
    "message": "***",
    "reason": "fieldValidationFailed"
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

AWS Enable Or Disable Region source medium: Detects when an AWS region is enabled or disabled.T1535↳ also matches EnableRegion

EnableRegion

Service: account

Description

Enables an AWS Region that was previously disabled for the account, allowing the account to use services in that Region.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS EnableRegion Command Monitoring source medium: Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment.

YARA-L #

AWS Enable Or Disable Region source medium: Detects when an AWS region is enabled or disabled.T1535↳ also matches DisableRegion

Panther #

AWS Cloudtrail Region Enabled source medium: Threat actors who successfully compromise a victim's AWS account, whether through stolen credentials, exposed access keys, exploited IAM misconfigurations, vulnerabilities in third-party applications, or the absence of Multi-Factor Authentication (MFA), can exploit unused regions as safe zones for malicious activities. These regions are often overlooked in monitoring and security setups, making them an attractive target for attackers to operate undetected.T1535

AcceptPrimaryEmailUpdate

Service: account

Description

Accepts the request that originated from StartPrimaryEmailUpdate to update the primary email address (also known as the root user email address) for the specified account.

DeleteAlternateContact

Service: account

Description

Deletes the specified alternate contact from an Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "81631741-7fca-4097-8869-619543d246a8",
  "eventName": "DeleteAlternateContact",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T19:21:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5ced2918-3370-4135-964e-1b997b9b3882",
  "requestParameters": {
    "AlternateContactType": "BILLING"
  },
  "responseElements": {
    "message": "No contact of the inputted alternate contact type found."
  },
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAccountInformation

Service: account

Description

Retrieves information about the specified account including its account name, account ID, account creation date and time, and account state.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "055d3c06-870c-46c0-a0ac-db18ada2ae76",
  "eventName": "GetAccountInformation",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T18:31:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "024520fc-30ee-412a-af31-378bac12e46a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetAlternateContact

Service: account

Description

Retrieves the specified alternate contact attached to an Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "ResourceNotFoundException",
  "eventCategory": "Management",
  "eventID": "2560da0a-de66-4c6a-a93a-c53d628082c9",
  "eventName": "GetAlternateContact",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T18:42:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "34d3b5bf-d367-464b-ba12-3af9bb8b7eee",
  "requestParameters": {
    "AlternateContactType": "BILLING"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS CloudTrail Account Discovery source informational: Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.T1087↳ also matches GetContactInformation, PutAlternateContact, PutContactInformation

GetContactInformation

Service: account

Description

Retrieves the primary contact information of an Amazon Web Services account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "a4727eb9-7e6a-4b03-8f60-b5a6cd01ff0b",
  "eventName": "GetContactInformation",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T18:31:26Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "384784b6-a028-47a9-9393-b218cd41281e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS CloudTrail Account Discovery source informational: Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.T1087↳ also matches GetAlternateContact, PutAlternateContact, PutContactInformation

GetGovCloudAccountInformation

Service: account

Description

Retrieves information about the GovCloud account linked to the specified standard account (if it exists) including the GovCloud account ID and state.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "GovCloudAccountDoesNotExist",
  "eventCategory": "Management",
  "eventID": "09d0f6da-a6e7-48e4-b292-aa7447f1414c",
  "eventName": "GetGovCloudAccountInformation",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T18:31:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "40b45159-1708-48fa-9a90-20622523ee4b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPrimaryEmail

Service: account

Description

Retrieves the primary email address for the specified account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "eventCategory": "Management",
  "eventID": "0b8cca02-b0b3-4d75-9c26-bab0a22f26e5",
  "eventName": "GetPrimaryEmail",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T18:42:39Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b49bd68a-ce42-4d49-af74-cb55510bd58b",
  "requestParameters": {
    "AccountId": "dw-probe"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRegionOptStatus

Service: account

Description

Retrieves the opt-in status of a particular Region.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "875240ac-e821-4fc6-a311-8c352a1d20f5",
  "eventName": "GetRegionOptStatus",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2023-07-10T11:42:18Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "699479d4-2a01-4e9e-bf31-4ec5dc88677e",
  "requestParameters": {
    "RegionName": "eu-north-1"
  },
  "responseElements": null,
  "sourceIPAddress": "10.248.16.43",
  "userAgent": "Boto3/1.26.165 Python/3.10.6 Linux/5.19.0-46-generic Botocore/1.29.165",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSCUXC3DDDP",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/benjamin",
    "principalId": "AIDATFQR7NSC5U6Q3TMDR",
    "type": "IAMUser",
    "userName": "benjamin"
  }
}

References #

Sample log: invictus-ir/aws_dataset

ListRegions

Service: account

Description

Lists all the Regions for a given account and their respective opt-in statuses.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "4eb43640-822c-418f-8ce0-6411e8163cfc",
  "eventName": "ListRegions",
  "eventSource": "account.amazonaws.com",
  "eventTime": "2026-06-29T18:31:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "d1c7d477-e8aa-4ddb-bb24-f71f247e978a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutAccountName

Service: account

Description

Updates the account name of the specified account.

PutAlternateContact

Service: account

Description

Modifies the specified alternate contact attached to an Amazon Web Services account.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS CloudTrail Account Discovery source informational: Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.T1087↳ also matches GetAlternateContact, GetContactInformation, PutContactInformation

PutContactInformation

Service: account

Description

Updates the primary contact information of an Amazon Web Services account.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS CloudTrail Account Discovery source informational: Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.T1087↳ also matches GetAlternateContact, GetContactInformation, PutAlternateContact

StartPrimaryEmailUpdate

Service: account

Description

Starts the process to update the primary email address for the specified account.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "216aeca3-84c7-40f9-9287-61715f6805fe",
  "eventSource": "account.amazonaws.com",
  "eventName": "StartPrimaryEmailUpdate",
  "awsRegion": "us-east-1",
  "eventType": "AwsApiCall",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "eb4ba1a3-ea37-4c68-8d8c-6fa83a09c42a",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36",
  "errorCode": "AccessDenied"
}

GetPrimaryEmailUpdateStatus

Service: account

Description

Retrieves the status of the most recent primary email update for the specified account.

AWS Account Management

any: AWS Account Management (catch-all)

Description

DisableRegion

Description

Example CloudTrail Event #

Related events #

Detection Rules #

YARA-L #

EnableRegion

Description

Related events #

Detection Rules #

Sigma #

YARA-L #

Panther #

AcceptPrimaryEmailUpdate

Description

DeleteAlternateContact

Description

Example CloudTrail Event #

GetAccountInformation

Description

Example CloudTrail Event #

GetAlternateContact

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

GetContactInformation

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

GetGovCloudAccountInformation

Description

Example CloudTrail Event #

GetPrimaryEmail

Description

Example CloudTrail Event #

GetRegionOptStatus

Description

Example CloudTrail Event #

References #

ListRegions

Description

Example CloudTrail Event #

PutAccountName

Description

PutAlternateContact

Description

Related events #

Detection Rules #

Panther #

PutContactInformation

Description

Related events #

Detection Rules #

Panther #

StartPrimaryEmailUpdate

Description

Example CloudTrail Event #

GetPrimaryEmailUpdateStatus

Description