Detection rules › Kusto
AWSCloudTrail - User IAM Enumeration
Detects enumeration of IAM account configuration via repeated API calls to list roles, users, groups, and policies within a short time period. The threshold can be adjusted to reduce false positives from authorized cloud scanners such as Wiz.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
Rule body
id: cfaaf0bc-16d1-48df-ac8b-9d901bbd516a
name: AWSCloudTrail - User IAM Enumeration
description: |
Detects enumeration of IAM account configuration via repeated API calls to list roles, users, groups, and policies within a short time period. The threshold can be adjusted to reduce false positives from authorized cloud scanners such as Wiz.
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: AWS
dataTypes:
- AWSCloudTrail
queryFrequency: 10m
queryPeriod: 10m
triggerOperator: gt
triggerThreshold: 0
tactics:
- Discovery
relevantTechniques:
- T1580
query: |
let threshold = 50;
AWSCloudTrail
| where EventName in ("ListAttachedRolePolicies","ListRoles","ListGroupsForUser","ListAttachedUserPolicies","ListAccessKeys","ListUsers")
| summarize
count(),
make_set(AWSRegion),
make_set(UserAgent),
make_set(SourceIpAddress),
make_set(ErrorCode),
make_set(ErrorMessage),
make_set(EventName)
by bin(TimeGenerated, 10m), UserIdentityPrincipalid, UserIdentityArn, UserIdentityAccountId
| where count_ > threshold
| mv-expand set_SourceIpAddress
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
entityMappings:
- entityType: Account
fieldMappings:
- identifier: Name
columnName: Name
- identifier: UPNSuffix
columnName: UpnSuffix
- entityType: IP
fieldMappings:
- identifier: Address
columnName: set_SourceIpAddress
customDetails:
EventCount: count_
AWSAccountId: UserIdentityAccountId
PrincipalId: UserIdentityPrincipalid
alertDetailsOverride:
alertDisplayNameFormat: IAM enumeration detected - {{count_}} API calls by {{UserIdentityPrincipalid}}
alertDescriptionFormat: User {{UserIdentityPrincipalid}} performed {{count_}} IAM enumeration API calls within a 10-minute window from account {{UserIdentityAccountId}}.
version: 1.0.1
kind: Scheduled
Stages and Predicates
Parameters
let threshold = 50;
Stage 1: source
AWSCloudTrail
Stage 2: where
| where EventName in ("ListAttachedRolePolicies","ListRoles","ListGroupsForUser","ListAttachedUserPolicies","ListAccessKeys","ListUsers")
Stage 3: summarize
| summarize
count(),
make_set(AWSRegion),
make_set(UserAgent),
make_set(SourceIpAddress),
make_set(ErrorCode),
make_set(ErrorMessage),
make_set(EventName)
by bin(TimeGenerated, 10m), UserIdentityPrincipalid, UserIdentityArn, UserIdentityAccountId
Stage 4: where
| where count_ > threshold
Stage 5: mv-expand
| mv-expand set_SourceIpAddress
Stage 6: extend
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
Stage 7: extend
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventName | in |
| field:"aws::eventName" kind:in |
count_ | gt |
| field:"count_" kind:gt value:"50" |
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
UserIdentityAccountId | summarize |
UserIdentityArn | summarize |
UserIdentityPrincipalid | summarize |
UserName | extend |
Name | extend |
UpnSuffix | extend |