AWS Security Hub - Detect IAM root user Access Key existence

Back


Id	171cbece-be87-4467-8754-63d82b3d3dfb
Rulename	AWS Security Hub - Detect IAM root user Access Key existence
Description	This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed.
Severity	High
Tactics	PrivilegeEscalation Persistence
Techniques	T1134.001 T1134.003 T1098.001
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
Version	1.0.0
Arm template	171cbece-be87-4467-8754-63d82b3d3dfb.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
  or tostring(ComplianceSecurityControlId) == "IAM.4"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

YAML

query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
    or tostring(ComplianceSecurityControlId) == "IAM.4"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN  
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
description: |
  This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.
  A root user Access Key presents a high risk of privilege abuse and should be removed.  
queryPeriod: 1h
triggerOperator: gt
tags:
- PCI DSS v3.2.1
- NIST 800-53 r5
- CIS AWS Foundations Benchmark v1.4.0
alertDetailsOverride:
  alertDisplayNameFormat: AWS Account {{AwsAccountId}} root access key exists
  alertDescriptionFormat: 'AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}}).'
queryFrequency: 1h
version: 1.0.0
id: 171cbece-be87-4467-8754-63d82b3d3dfb
tactics:
- PrivilegeEscalation
- Persistence
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AwsAccountId
  - identifier: CloudAppAccountId
    columnName: RootUserARN
  entityType: Account
requiredDataConnectors:
- dataTypes:
  - AWSSecurityHubFindings
  connectorId: AWSSecurityHub
name: AWS Security Hub - Detect IAM root user Access Key existence
severity: High
customDetails:
  FindingId: AwsSecurityFindingId
  Region: AwsRegion
  ComplianceControlId: ComplianceSecurityControlId
  RootUserARN: RootUserARN
triggerThreshold: 0
kind: Scheduled
relevantTechniques:
- T1134.001
- T1134.003
- T1098.001

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/171cbece-be87-4467-8754-63d82b3d3dfb')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/171cbece-be87-4467-8754-63d82b3d3dfb')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}}).",
          "alertDisplayNameFormat": "AWS Account {{AwsAccountId}} root access key exists"
        },
        "alertRuleTemplateName": "171cbece-be87-4467-8754-63d82b3d3dfb",
        "customDetails": {
          "ComplianceControlId": "ComplianceSecurityControlId",
          "FindingId": "AwsSecurityFindingId",
          "Region": "AwsRegion",
          "RootUserARN": "RootUserARN"
        },
        "description": "This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.\nA root user Access Key presents a high risk of privilege abuse and should be removed.\n",
        "displayName": "AWS Security Hub - Detect IAM root user Access Key existence",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AwsAccountId",
                "identifier": "Name"
              },
              {
                "columnName": "RootUserARN",
                "identifier": "CloudAppAccountId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml",
        "query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/IAM.4\"\n  or tostring(ComplianceSecurityControlId) == \"IAM.4\"\n| extend RootUserARN = tostring(Resources[0].Id)\n| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1134.001",
          "T1134.003",
          "T1098.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "tags": [
          "PCI DSS v3.2.1",
          "NIST 800-53 r5",
          "CIS AWS Foundations Benchmark v1.4.0"
        ],
        "techniques": [
          "T1098",
          "T1134"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}