MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1078 Valid Accounts |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS Console Login (Panther)
- AWS Console Login Failed During MFA Challenge (Splunk)
- AWS ConsoleLogin Failed Authentication (Sigma)
- AWS CreateLoginProfile (Splunk)
- AWS Credential Access Failed Login (Splunk)
- AWS High Number Of Failed Authentications For User (Splunk)
- AWS High Number Of Failed Authentications From Ip (Splunk)
- AWS Multiple Failed MFA Requests For User (Splunk)
Rule body yaml
AnalysisType: rule
Filename: aws_console_root_login.py
RuleID: "AWS.Console.RootLogin"
DisplayName: "Root Console Login"
Enabled: true
DedupPeriodMinutes: 15
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Identity & Access Management
- Authentication
- DemoThreatHunting
- Privilege Escalation:Valid Accounts
Reports:
CIS:
- 3.6
MITRE ATT&CK:
- TA0004:T1078
Severity: High
Description: The root account has been logged into.
Runbook: >
Investigate the usage of the root account. If this root activity was not authorized, immediately change the root credentials and investigate what actions the root account took.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
SummaryAttributes:
- userAgent
- sourceIpAddress
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: Successful Root Login
ExpectedResult: true
Mocks:
- objectName: geoinfo_from_ip_formatted
returnValue: "111.111.111.111 in SF, California in USA"
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "Root",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:root",
"accountId": "123456789012",
"userName": "root",
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "signin.amazonaws.com",
"eventName": "ConsoleLogin",
"awsRegion": "us-east-1",
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla",
"requestParameters": null,
"responseElements": { "ConsoleLogin": "Success" },
"additionalEventData":
{
"LoginTo": "https://console.aws.amazon.com/console/",
"MobileVersion": "No",
"MFAUsed": "No",
},
"eventID": "1",
"eventType": "AwsConsoleSignIn",
"recipientAccountId": "123456789012",
}
- Name: Non-Login Event
ExpectedResult: false
Log:
{
"eventVersion": "1.06",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:user/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:user/tester",
"accountId": "123456789012",
"userName": "tester",
},
"attributes":
{
"creationDate": "2019-01-01T00:00:00Z",
"mfaAuthenticated": "true",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "dynamodb.amazonaws.com",
"eventName": "DescribeTable",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "console.amazonaws.com",
"requestParameters": { "tableName": "table" },
"responseElements": null,
"requestID": "1",
"eventID": "1",
"readOnly": true,
"resources":
[
{
"accountId": "123456789012",
"type": "AWS::DynamoDB::Table",
"ARN": "arn::::table/table",
},
],
"eventType": "AwsApiCall",
"apiVersion": "2012-08-10",
"managementEvent": true,
"recipientAccountId": "123456789012",
}
Detection logic
Condition
eventName eq "ConsoleLogin"
userIdentity.type eq "Root"
responseElements.ConsoleLogin eq "Success"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
responseElements.ConsoleLogin | eq |
|
userIdentity.type | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
sourceIPAddress | |
userIdentityAccountId | userIdentity.accountId |
userIdentityArn | userIdentity.arn |
eventTime | |
mfaUsed | additionalEventData.MFAUsed |
recipientAccountId |