AWS Root Credentials

calendar Oct 23, 2025 · attack.privilege-escalation attack.defense-evasion attack.initial-access attack.persistence attack.t1078.004  ·
Share on: linkedin copy

Detects AWS root account usage

Sigma rule (View on GitHub)

 1title: AWS Root Credentials
 2id: 8ad1600d-e9dc-4251-b0ee-a65268f29add
 3status: test
 4description: Detects AWS root account usage
 5references:
 6    - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
 7author: vitaliy0x1
 8date: 2020-01-21
 9modified: 2022-10-09
10tags:
11    - attack.privilege-escalation
12    - attack.defense-evasion
13    - attack.initial-access
14    - attack.persistence
15    - attack.t1078.004
16logsource:
17    product: aws
18    service: cloudtrail
19detection:
20    selection_usertype:
21        userIdentity.type: Root
22    selection_eventtype:
23        eventType: AwsServiceEvent
24    condition: selection_usertype and not selection_eventtype
25falsepositives:
26    - AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html
27level: medium

References

Related rules

to-top