AWS CloudTrail: Root User Activity for Account Access

Alerts on CloudTrail activity performed by AWS account root credentials.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-root-user-activity-for-account-access-8ad1600d

title: "AWS CloudTrail: Root User Activity for Account Access"
id: 48fcd35b-8655-492a-a024-2cc982eea159
status: test
description: This rule flags CloudTrail events where the caller identity user type is Root, indicating use of AWS account root credentials. Attackers may leverage root access for high-privilege actions and to establish persistence, so root usage is high-signal despite being infrequent. It relies on CloudTrail event telemetry, specifically userIdentity.type values and the absence of the generic AwsServiceEvent eventType field.
references:
  - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_root_account_usage.yml
author: vitaliy0x1, Huntrule Team
date: 2020-01-21
modified: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_usertype:
    userIdentity.type: Root
  selection_eventtype:
    eventType: AwsServiceEvent
  condition: selection_usertype and not selection_eventtype
falsepositives:
  - AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html
level: medium
license: DRL-1.1
related:
  - id: 8ad1600d-e9dc-4251-b0ee-a65268f29add
    type: derived

What it detects

This rule flags CloudTrail events where the caller identity user type is Root, indicating use of AWS account root credentials. Attackers may leverage root access for high-privilege actions and to establish persistence, so root usage is high-signal despite being infrequent. It relies on CloudTrail event telemetry, specifically userIdentity.type values and the absence of the generic AwsServiceEvent eventType field.

Known false positives

AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.