AWS Management Console Brute Force of Root User Identity

 1[metadata]
 2creation_date = "2020/07/21"
 3integration = ["aws"]
 4maturity = "production"
 5min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0"
 6min_stack_version = "8.9.0"
 7updated_date = "2024/04/14"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An
13adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services
14and resources for the AWS account.
15"""
16false_positives = [
17    """
18    Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false
19    positives.
20    """,
21]
22from = "now-20m"
23index = ["filebeat-*", "logs-aws.cloudtrail-*"]
24language = "kuery"
25license = "Elastic License v2"
26name = "AWS Management Console Brute Force of Root User Identity"
27note = """## Setup
28
29The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
30references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"]
31risk_score = 73
32rule_id = "4d50a94f-2844-43fa-8395-6afbd5e1c5ef"
33severity = "high"
34tags = ["Domain: Cloud", "Data Source: AWS", "Data Source: Amazon Web Services", "Use Case: Identity and Access Audit", "Tactic: Credential Access"]
35type = "threshold"
36timestamp_override = "event.ingested"
37
38query = '''
39event.dataset:aws.cloudtrail and event.provider:signin.amazonaws.com and event.action:ConsoleLogin and aws.cloudtrail.user_identity.type:Root and event.outcome:failure
40'''
41
42
43[[rule.threat]]
44framework = "MITRE ATT&CK"
45[[rule.threat.technique]]
46id = "T1110"
47name = "Brute Force"
48reference = "https://attack.mitre.org/techniques/T1110/"
49
50
51[rule.threat.tactic]
52id = "TA0006"
53name = "Credential Access"
54reference = "https://attack.mitre.org/tactics/TA0006/"
55
56[rule.threshold]
57field = ["cloud.account.id"]
58value = 10