AWS Security Hub - Detect IAM root user Access Key existence

Status: available
Severity: high
Time window: 1h
Group by: AwsAccountId, AwsRegion, AwsSecurityFindingDescription, AwsSecurityFindingId, AwsSecurityFindingTitle, ComplianceSecurityControlId, RootUserARN
Source: github.com/Azure/Azure-Sentinel

This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098.001` Account Manipulation: Additional Cloud Credentials
Privilege Escalation	`T1098.001` Account Manipulation: Additional Cloud Credentials `T1134.001` Access Token Manipulation: Token Impersonation/Theft `T1134.003` Access Token Manipulation: Make and Impersonate Token

Rule body

id: 171cbece-be87-4467-8754-63d82b3d3dfb
name: AWS Security Hub - Detect IAM root user Access Key existence
description: |
  This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.
  A root user Access Key presents a high risk of privilege abuse and should be removed.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: AWSSecurityHub
    dataTypes:
      - AWSSecurityHubFindings
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - PrivilegeEscalation
  - Persistence
relevantTechniques:
  - T1134.001
  - T1134.003
  - T1098.001
tags:
  - PCI DSS v3.2.1
  - NIST 800-53 r5
  - CIS AWS Foundations Benchmark v1.4.0
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
    or tostring(ComplianceSecurityControlId) == "IAM.4"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AwsAccountId
      - identifier: CloudAppAccountId
        columnName: RootUserARN
customDetails:
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
  FindingId: AwsSecurityFindingId
  RootUserARN: RootUserARN
alertDetailsOverride:
  alertDisplayNameFormat: "AWS Account {{AwsAccountId}} root access key exists"
  alertDescriptionFormat: "AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}})."
version: 1.0.0
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSSecurityHubFindings

Stage 2: `where`

| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"

Stage 3: `where`

| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
  or tostring(ComplianceSecurityControlId) == "IAM.4"

Stage 4: `extend`

| extend RootUserARN = tostring(Resources[0].Id)

Stage 5: `summarize`

| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AwsSecurityFindingGeneratorId`	eq	`security-control/IAM.4` transforms: `tostring`	`field:"AwsSecurityFindingGeneratorId" kind:eq value:"security-control/IAM.4"`
`ComplianceSecurityControlId`	eq	`IAM.4` transforms: `tostring`	`field:"ComplianceSecurityControlId" kind:eq value:"IAM.4"`
`ComplianceStatus`	eq	`FAILED`	`field:"ComplianceStatus" kind:eq value:"FAILED"`
`RecordState`	eq	`ACTIVE`	`field:"RecordState" kind:eq value:"ACTIVE"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AwsAccountId`	`summarize`
`AwsRegion`	`summarize`
`AwsSecurityFindingDescription`	`summarize`
`AwsSecurityFindingId`	`summarize`
`AwsSecurityFindingTitle`	`summarize`
`ComplianceSecurityControlId`	`summarize`
`RootUserARN`	`summarize`
`TimeGenerated`	`summarize`

AWS Security Hub - Detect IAM root user Access Key existence

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend