AWS Security Hub - Detect root user lacking MFA | Microsoft Sentinel Analytic Rules

Back


Id	6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44
Rulename	AWS Security Hub - Detect root user lacking MFA
Description	This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings. Lack of MFA on the root user increases the risk of unauthorized access and privilege abuse.
Severity	High
Tactics	PrivilegeEscalation Persistence CredentialAccess DefenseEvasion
Techniques	T1098 T1110 T1556.006
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS%20Security%20Hub/Analytic%20Rules/IAMRootUserMFADisabled.yaml
Version	1.0.0
Arm template	6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.9"
  or tostring(ComplianceSecurityControlId) == "IAM.9"
| extend RootUserARN = tostring(Resources[0].Id)
| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN

YAML

requiredDataConnectors:
- dataTypes:
  - AWSSecurityHubFindings
  connectorId: AWSSecurityHub
tags:
- PCI DSS v3.2.1
- NIST 800-53 r5
- CIS AWS Foundations Benchmark v1.4.0
version: 1.0.0
status: Available
alertDetailsOverride:
  alertDescriptionFormat: 'AWS Account {{AwsAccountId}} has root user without MFA (Resource: {{RootUserARN}}).'
  alertDisplayNameFormat: AWS Account {{AwsAccountId}} root user lacks MFA
customDetails:
  RootUserARN: RootUserARN
  FindingId: AwsSecurityFindingId
  Region: AwsRegion
  ComplianceControlId: ComplianceSecurityControlId
queryFrequency: 1h
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/IAM.9"
    or tostring(ComplianceSecurityControlId) == "IAM.9"
  | extend RootUserARN = tostring(Resources[0].Id)
  | summarize TimeGenerated = max(TimeGenerated)
      by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
         AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN
tactics:
- PrivilegeEscalation
- Persistence
- CredentialAccess
- DefenseEvasion
relevantTechniques:
- T1098
- T1110
- T1556.006
id: 6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS%20Security%20Hub/Analytic%20Rules/IAMRootUserMFADisabled.yaml
name: AWS Security Hub - Detect root user lacking MFA
queryPeriod: 1h
severity: High
entityMappings:
- fieldMappings:
  - columnName: AwsAccountId
    identifier: Name
  - columnName: RootUserARN
    identifier: CloudAppAccountId
  entityType: Account
kind: Scheduled
description: |
  This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings.
  Lack of MFA on the root user increases the risk of unauthorized access and privilege abuse.

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44')]",
      "properties": {
        "alertDetailsOverride": {
          "alertDescriptionFormat": "AWS Account {{AwsAccountId}} has root user without MFA (Resource: {{RootUserARN}}).",
          "alertDisplayNameFormat": "AWS Account {{AwsAccountId}} root user lacks MFA"
        },
        "alertRuleTemplateName": "6b3b9b1d-0d5d-4d4a-9f0f-8d1e2c7a5f44",
        "customDetails": {
          "ComplianceControlId": "ComplianceSecurityControlId",
          "FindingId": "AwsSecurityFindingId",
          "Region": "AwsRegion",
          "RootUserARN": "RootUserARN"
        },
        "description": "This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings.\nLack of MFA on the root user increases the risk of unauthorized access and privilege abuse.\n",
        "displayName": "AWS Security Hub - Detect root user lacking MFA",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AwsAccountId",
                "identifier": "Name"
              },
              {
                "columnName": "RootUserARN",
                "identifier": "CloudAppAccountId"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS%20Security%20Hub/Analytic%20Rules/IAMRootUserMFADisabled.yaml",
        "query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/IAM.9\"\n  or tostring(ComplianceSecurityControlId) == \"IAM.9\"\n| extend RootUserARN = tostring(Resources[0].Id)\n| summarize TimeGenerated = max(TimeGenerated)\n    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,\n       AwsSecurityFindingId, ComplianceSecurityControlId, RootUserARN\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "High",
        "status": "Available",
        "subTechniques": [
          "T1556.006"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion",
          "Persistence",
          "PrivilegeEscalation"
        ],
        "tags": [
          "PCI DSS v3.2.1",
          "NIST 800-53 r5",
          "CIS AWS Foundations Benchmark v1.4.0"
        ],
        "techniques": [
          "T1098",
          "T1110",
          "T1556"
        ],
        "templateVersion": "1.0.0",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}