AWS root account usage Configuration by crowdsecurity | CrowdSec Hub

AWS root account usage

Attack scenariocloud:unusual-activityMITRE T1078MITRE T1098

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/aws-cis-benchmark-root-usage
Remediation: Alert only

Detect AWS root account usage

Install with a top-level collection

1 collection include it

sudo cscli collections install crowdsecurity/aws-cis-benchmark

Installs 1 parser and 14 scenarios.

View AWS - CIS Benchmark →

Installation

sudo cscli scenarios install crowdsecurity/aws-cis-benchmark-root-usage

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/aws-cis-benchmark-root-usage.yaml· 19 linesGitHub

1type: trigger1
2name: crowdsecurity/aws-cis-benchmark-root-usage
3description: "Detect AWS root account usage"
4filter: |2
5  evt.Meta.log_type == 'aws-cloudtrail' &&
6  evt.Unmarshaled.cloudtrail.userIdentity.type == "Root" &&
7  evt.Unmarshaled.cloudtrail.userIdentity.invokedBy == nil &&
8  evt.Unmarshaled.cloudtrail.eventType != "AwsServiceEvent"
9labels:
10  confidence: 3
11  spoofable: 0
12  classification:3
13    - attack.T1078
14    - attack.T1098
15  behavior: "cloud:unusual-activity"
16  label: "AWS root account usage"
17  service: aws
18  cti: false
19  remediation: false4

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detects usage of the AWS root account based on cloutrail logs (Section 1.7 of CIS AWS Foundation Benchmark 1.4.0 ).