Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect AWS root user activity.

Strategy

Monitor CloudTrail and detect when any @userIdentity.type has a value of Root, but is not invoked by an AWS service or SAML provider.

Triage and response

1. Determine if the root API Call: {{@evt.name}} is expected.
2. If the action wasn’t legitimate, rotate the credentials, enable 2FA, and open an investigation.

• For best practices, check out the AWS Root Account Best Practices documentation.
• For compliance, check out the CIS AWS Foundations Benchmark controls documentation.