AWS Security Hub - Detect IAM root user Access Key existence

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This query detects AWS Security Hub control IAM.4 findings indicating that an AWS account root user Access Key exists. A root user Access Key presents a high risk of privilege abuse and should be removed.

Attribute	Value
Type	Analytic Rule
Solution	AWS Security Hub
ID	171cbece-be87-4467-8754-63d82b3d3dfb
Severity	High
Status	Available
Kind	Scheduled
Tactics	PrivilegeEscalation, Persistence
Techniques	T1134.001, T1134.003, T1098.001
Required Connectors	AWSSecurityHub
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
AWSSecurityHubFindings	✓	✓	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules · Back to AWS Security Hub