AWS Security Hub - Detect IAM root user Access Key existence

Back


Id	171cbece-be87-4467-8754-63d82b3d3dfb
Rulename	AWS Security Hub - Detect IAM root user Access Key existence
Description	This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed.
Severity	High
Tactics	PrivilegeEscalation Persistence
Techniques	T1134.001 T1134.003 T1098.001
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
Version	1.0.0
Arm template	171cbece-be87-4467-8754-63d82b3d3dfb.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
  or tostring(ComplianceSecurityControlId) == "IAM.4"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

YAML

name: AWS Security Hub - Detect IAM root user Access Key existence
alertDetailsOverride:
  alertDisplayNameFormat: AWS Account {{AwsAccountId}} root access key exists
  alertDescriptionFormat: 'AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}}).'
id: 171cbece-be87-4467-8754-63d82b3d3dfb
description: |
  This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.
  A root user Access Key presents a high risk of privilege abuse and should be removed.  
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AwsAccountId
    identifier: Name
  - columnName: RootUserARN
    identifier: CloudAppAccountId
  entityType: Account
version: 1.0.0
triggerOperator: gt
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
    or tostring(ComplianceSecurityControlId) == "IAM.4"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN  
tactics:
- PrivilegeEscalation
- Persistence
kind: Scheduled
queryFrequency: 1h
tags:
- PCI DSS v3.2.1
- NIST 800-53 r5
- CIS AWS Foundations Benchmark v1.4.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
severity: High
queryPeriod: 1h
requiredDataConnectors:
- dataTypes:
  - AWSSecurityHubFindings
  connectorId: AWSSecurityHub
status: Available
customDetails:
  RootUserARN: RootUserARN
  FindingId: AwsSecurityFindingId
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
relevantTechniques:
- T1134.001
- T1134.003
- T1098.001

ARM