1type: trigger
2name: crowdsecurity/aws-cis-benchmark-root-usage
3description: "Detect AWS root account usage"
4filter: |
5  evt.Meta.log_type == 'aws-cloudtrail' &&
6  evt.Unmarshaled.cloudtrail.userIdentity.type == "Root" &&
7  evt.Unmarshaled.cloudtrail.userIdentity.invokedBy == nil &&
8  evt.Unmarshaled.cloudtrail.eventType != "AwsServiceEvent"
9labels:
10  confidence: 3
11  spoofable: 0
12  classification:
13    - attack.T1078
14    - attack.T1098
15  behavior: "cloud:unusual-activity"
16  label: "AWS root account usage"
17  service: aws
18  cti: false
19  remediation: false
20