AWS Security Hub - Detect IAM root user Access Key existence

Back


Id	171cbece-be87-4467-8754-63d82b3d3dfb
Rulename	AWS Security Hub - Detect IAM root user Access Key existence
Description	This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed.
Severity	High
Tactics	PrivilegeEscalation Persistence
Techniques	T1134.001 T1134.003 T1098.001
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
Version	1.0.0
Arm template	171cbece-be87-4467-8754-63d82b3d3dfb.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
  or tostring(ComplianceSecurityControlId) == "IAM.4"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

YAML

tactics:
- PrivilegeEscalation
- Persistence
name: AWS Security Hub - Detect IAM root user Access Key existence
id: 171cbece-be87-4467-8754-63d82b3d3dfb
requiredDataConnectors:
- connectorId: AWSSecurityHub
  dataTypes:
  - AWSSecurityHubFindings
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.4"
    or tostring(ComplianceSecurityControlId) == "IAM.4"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN  
relevantTechniques:
- T1134.001
- T1134.003
- T1098.001
description: |
  This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.
  A root user Access Key presents a high risk of privilege abuse and should be removed.  
triggerOperator: gt
queryPeriod: 1h
severity: High
entityMappings:
- fieldMappings:
  - identifier: Name
    columnName: AwsAccountId
  - identifier: CloudAppAccountId
    columnName: RootUserARN
  entityType: Account
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml
version: 1.0.0
alertDetailsOverride:
  alertDisplayNameFormat: AWS Account {{AwsAccountId}} root access key exists
  alertDescriptionFormat: 'AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}}).'
triggerThreshold: 0
tags:
- PCI DSS v3.2.1
- NIST 800-53 r5
- CIS AWS Foundations Benchmark v1.4.0
kind: Scheduled
queryFrequency: 1h
status: Available
customDetails:
  ComplianceControlId: ComplianceSecurityControlId
  Region: AwsRegion
  FindingId: AwsSecurityFindingId
  RootUserARN: RootUserARN

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/171cbece-be87-4467-8754-63d82b3d3dfb')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/171cbece-be87-4467-8754-63d82b3d3dfb')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "AWS Account {{AwsAccountId}} has a root user access key (Resource: {{RootUserARN}}).",
          "alertDisplayNameFormat": "AWS Account {{AwsAccountId}} root access key exists"
        },
        "alertRuleTemplateName": "171cbece-be87-4467-8754-63d82b3d3dfb",
        "customDetails": {
          "ComplianceControlId": "ComplianceSecurityControlId",
          "FindingId": "AwsSecurityFindingId",
          "Region": "AwsRegion",
          "RootUserARN": "RootUserARN"
        },
        "description": "This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists.\nA root user Access Key presents a high risk of privilege abuse and should be removed.\n",
        "displayName": "AWS Security Hub - Detect IAM root user Access Key existence",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AwsAccountId",
                "identifier": "Name"
              },
              {
                "columnName": "RootUserARN",
                "identifier": "CloudAppAccountId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/IAMRootUserWithAccessKey.yaml",
        "query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/IAM.4\"\n  or tostring(ComplianceSecurityControlId) == \"IAM.4\"\n| extend RootUserARN = tostring(Resources[0].Id)\n| summarize TimeGenerated = max(TimeGenerated) by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription, AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1134.001",
          "T1134.003",
          "T1098.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Persistence",
          "PrivilegeEscalation"
        ],
        "tags": [
          "PCI DSS v3.2.1",
          "NIST 800-53 r5",
          "CIS AWS Foundations Benchmark v1.4.0"
        ],
        "techniques": [
          "T1098",
          "T1134"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}