AWS Security Hub - Detect IAM root user Access Key existence

Back


Id	171cbece-be87-4467-8754-63d82b3d3dfb
Rulename	AWS Security Hub - Detect IAM root user Access Key existence
Description	This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed.
Severity	High
Tactics	PrivilegeEscalation Persistence
Techniques	T1134.001 T1134.003 T1098.001
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
Version	1.0.0
Arm template	171cbece-be87-4467-8754-63d82b3d3dfb.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
  or tostring(ComplianceSecurityControlId) == "IAM.4"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

YAML

queryPeriod: 1h
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
    or tostring(ComplianceSecurityControlId) == "IAM.4"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN  
name: AWS Security Hub - Detect IAM root user Access Key existence
entityMappings:
- fieldMappings:
  - columnName: AwsAccountId
    identifier: Name
  - columnName: RootUserARN
    identifier: CloudAppAccountId
  entityType: Account
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
tags:
- PCI DSS v3.2.1
- NIST 800-53 r5
- CIS AWS Foundations Benchmark v1.4.0
requiredDataConnectors:
- connectorId: AWSSecurityHub
  dataTypes:
  - AWSSecurityHubFindings
description: |
  This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.
  A root user Access Key presents a high risk of privilege abuse and should be removed.  
kind: Scheduled
version: 1.0.0
alertDetailsOverride:
  alertDisplayNameFormat: AWS Account {{AwsAccountId}} root access key exists
  alertDescriptionFormat: 'AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}}).'
status: Available
severity: High
relevantTechniques:
- T1134.001
- T1134.003
- T1098.001
triggerOperator: gt
triggerThreshold: 0
customDetails:
  RootUserARN: RootUserARN
  Region: AwsRegion
  ComplianceControlId: ComplianceSecurityControlId
  FindingId: AwsSecurityFindingId
tactics:
- PrivilegeEscalation
- Persistence
id: 171cbece-be87-4467-8754-63d82b3d3dfb

ARM