AWS Security Hub - Detect root user lacking MFA

Status: available
Severity: high
Time window: 1h
Group by: AwsAccountId, AwsRegion, AwsSecurityFindingDescription, AwsSecurityFindingId, AwsSecurityFindingTitle, ComplianceSecurityControlId, RootUserARN
Source: github.com/Azure/Azure-Sentinel

This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings. Lack of MFA on the root user increases the risk of unauthorized access and privilege abuse.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation `T1556.006` Modify Authentication Process: Multi-Factor Authentication
Privilege Escalation	`T1098` Account Manipulation
Credential Access	`T1110` Brute Force `T1556.006` Modify Authentication Process: Multi-Factor Authentication

Rule body

id: 6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44
name: AWS Security Hub - Detect root user lacking MFA
description: |
  This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings.
  Lack of MFA on the root user increases the risk of unauthorized access and privilege abuse.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AWSSecurityHub
    dataTypes:
      - AWSSecurityHubFindings
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
  - Persistence
  - CredentialAccess
  - DefenseEvasion
relevantTechniques:
  - T1098
  - T1110
  - T1556.006
tags:
  - PCI DSS v3.2.1
  - NIST 800-53 r5
  - CIS AWS Foundations Benchmark v1.4.0
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.9"
    or tostring(ComplianceSecurityControlId) == "IAM.9"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated)
      by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
         AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AwsAccountId
      - identifier: CloudAppAccountId
        columnName: RootUserARN
customDetails:
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
  FindingId: AwsSecurityFindingId
  RootUserARN: RootUserARN
alertDetailsOverride:
  alertDisplayNameFormat: "AWS Account {{AwsAccountId}} root user lacks MFA"
  alertDescriptionFormat: "AWS Account {{AwsAccountId}} has root user without MFA (Resource: {{RootUserARN}})."
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSSecurityHubFindings

Stage 2: `where`

| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"

Stage 3: `where`

| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.9"
  or tostring(ComplianceSecurityControlId) == "IAM.9"

Stage 4: `extend`

| extend RootUserARN = tostring(Resources[0].Id)

Stage 5: `summarize`

| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AwsSecurityFindingGeneratorId`	eq	`security-control/IAM.9` transforms: `tostring`	`field:"AwsSecurityFindingGeneratorId" kind:eq value:"security-control/IAM.9"`
`ComplianceSecurityControlId`	eq	`IAM.9` transforms: `tostring`	`field:"ComplianceSecurityControlId" kind:eq value:"IAM.9"`
`ComplianceStatus`	eq	`FAILED`	`field:"ComplianceStatus" kind:eq value:"FAILED"`
`RecordState`	eq	`ACTIVE`	`field:"RecordState" kind:eq value:"ACTIVE"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AwsAccountId`	`summarize`
`AwsRegion`	`summarize`
`AwsSecurityFindingDescription`	`summarize`
`AwsSecurityFindingId`	`summarize`
`AwsSecurityFindingTitle`	`summarize`
`ComplianceSecurityControlId`	`summarize`
`RootUserARN`	`summarize`
`TimeGenerated`	`summarize`

AWS Security Hub - Detect root user lacking MFA

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend