Suspicious AWS Root Credentials (via cloudtrail)

title: Suspicious AWS Root Credentials (via cloudtrail)
id: a58e75af-dc2a-5c23-86fe-8f5d76dcde67
status: stable
description: This rule detects AWS root account use
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
author: Huntrule Team
date: 2026-02-19
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_usertype:
        userIdentity.type: Root
    selection_eventtype:
        eventType: AwsServiceEvent
    condition: selection_usertype and not selection_eventtype
falsepositives:
    - Unknown
level: medium