Detects when an AWS member account is registered as a delegated administrator for an AWS service via the RegisterDelegatedAdministrator API, which grants service-level administrative access across the entire AWS Organization to a member account. The rule ingests AWS CloudTrail logs (logs-aws.cloudtrail-*) and matches events where the provider is organizations.amazonaws.com, the action is RegisterDelegatedAdministrator, and the outcome is success. This can be abused by an attacker who compromises a management account with broad Organizations permissions to enroll an attacker-controlled member account as a delegated administrator, enabling organization-wide privilege escalation. The detection maps to MITRE ATT&CK techniques T1098.003 (Additional Cloud Roles) under Account Manipulation and T1484 (Domain or Tenant Policy Modification) under Privilege Escalation, reflecting persistence and escalation risks. While legitimate cloud operations may register delegated administrators for security tooling, this rule flags unexpected or unauthorized registrations for further investigation. To reduce false positives, correlate with approved delegated admin configurations and change-management records, and verify the legitimacy of the caller, service principal, and target account before alerting or remediating.