AWS Root Credentials

Title: AWS Root Credentials
Status: test
Description:Detects AWS root account usage
References:
  -https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
Author: vitaliy0x1
Date: 2020-01-21
modified:2022-10-09
Tags:

• -'attack.privilege-escalation'
• -'attack.initial-access'
• -'attack.persistence'
• -'attack.stealth'
• -'attack.t1078.004'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_usertype:
    userIdentity.type: 'Root'
  selection_eventtype:
    eventType: 'AwsServiceEvent'
  condition:selection_usertype and not selection_eventtype
Falsepositives:
  -AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html
Level: medium