Rules Contributing to Suspicious AWS Root Account Activity Alert

Rule ID

aws_12

Query

{'selection1': {'eventSource': 'signin.amazonaws.com'}, 'selection_usertype': {'userIdentity_type': 'Root'}, 'selection_eventtype': {'eventType': 'AwsServiceEvent'}, 'condition': 'selection1 and selection_usertype and not selection_eventtype'}

Log Source

Stellar Cyber AWS configured for:

• AWS Cloudtrail

Rule Source

SigmaHQ,8ad1600d-e9dc-4251-b0ee-a65268f29add

Author: vitaliy0x1

Tactics, Techniques, and Procedures

TA0003, T1078.004

References

Severity

50

Suppression Logic Based On

• service_id
• eventSource
• eventName
• stellar.rule_id

Additional Information

Maturity	Creation Date	Risk Level	False Positives
test	2020/01/21	medium	AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html

Rule ID

aws_31

Query

{'selection1': {'eventSource': 'signin.amazonaws.com'}, 'selection2': {'eventName': 'ConsoleLogin'}, 'selection3': {'userIdentity_type': 'Root'}, 'condition': 'selection1 and selection2 and selection3'}

Log Source

Stellar Cyber AWS configured.

Rule Source

Developed internally by Stellar Cyber

Tactics, Techniques, and Procedures

TA0001, TA0003, T1078, T1078

References

Severity

50

Suppression Logic Based On

• service_id
• eventSource
• eventName
• stellar.rule_id

Additional Information

Maturity	Creation Date	Risk Level	False Positives
production	2020/06/11	medium	It's strongly recommended that the root user is not used for everyday tasks, including the administrative ones. Verify whether the IP address, location, and/or hostname should be logging in as root in your environment. Unfamiliar root logins should be investigated immediately. If known behavior is causing false positives, it can be exempted from the rule.