AWS root account usage
Direct use of the AWS account root identity.
What it detects
Direct use of the AWS account root identity. Root has unrestricted, unscoped access and should almost never be used for day-to-day API calls; activity under the root principal is a strong sign of misuse or a compromised master credential and warrants immediate review.
MITRE ATT&CK mapping
- T1078.004Valid Accounts: Cloud Accounts· Initial Access
False positives and triage
Break-glass root use is occasionally legitimate (initial account setup, certain billing/support actions). Confirm the action was planned, performed by an authorized operator, and that root MFA and alerting are enabled.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/cloud/aws_root_account_usage.yaml, licensed under the Apache License 2.0.
id: cloud.aws.root_account_usage
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [application]
mitre_techniques: [T1078.004]
description: |
Direct use of the AWS account root identity. Root has unrestricted, unscoped access and
should almost never be used for day-to-day API calls; activity under the root principal
is a strong sign of misuse or a compromised master credential and warrants immediate
review.
match:
provider: AWS
raw_message_contains_any:
- "identity_type=Root"
correlation_keys: [user_name]
false_positive_guidance: |
Break-glass root use is occasionally legitimate (initial account setup, certain
billing/support actions). Confirm the action was planned, performed by an authorized
operator, and that root MFA and alerting are enabled.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.