Root Password Changed

AnalysisType: rule
Filename: aws_root_password_changed.py
RuleID: "AWS.CloudTrail.RootPasswordChanged"
DisplayName: "Root Password Changed"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Identity and Access Management
  - Persistence:Account Manipulation
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0003:T1098
Description: >
  Someone manually changed the Root console login password.
Runbook: >
  Verify that the root password change was authorized. If not, AWS support should be contacted immediately as the root account cannot be recovered through normal means and grants complete access to the account.
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_change-root.html
SummaryAttributes:
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: Root Password Changed
    ExpectedResult: true
    Log:
      {
        "awsRegion": "us-east-1",
        "eventID": "1111",
        "eventName": "PasswordUpdated",
        "eventSource": "signin.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsConsoleSignIn",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": null,
        "responseElements": { "PasswordUpdated": "Success" },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36",
        "userIdentity":
          {
            "accesKeyId": "1111",
            "accessKeyId": "",
            "accountId": "123456789012",
            "arn": "arn:aws:iam::123456789012:root",
            "principalId": "123456789012",
            "type": "Root",
          },
      }
  - Name: Root Password Change Failed
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-east-1",
        "eventID": "1111",
        "eventName": "PasswordUpdated",
        "eventSource": "signin.amazonaws.com",
        "eventTime": "2019-01-01T00:00:00Z",
        "eventType": "AwsConsoleSignIn",
        "eventVersion": "1.05",
        "recipientAccountId": "123456789012",
        "requestID": "1111",
        "requestParameters": null,
        "responseElements": { "PasswordUpdated": "Failure" },
        "sourceIPAddress": "111.111.111.111",
        "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36",
        "userIdentity":
          {
            "accesKeyId": "1111",
            "accessKeyId": "",
            "accountId": "123456789012",
            "arn": "arn:aws:iam::123456789012:root",
            "principalId": "123456789012",
            "type": "Root",
          },
      }


# ------ paired body: aws_root_password_changed.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    # Only check password update changes
    if event.get("eventName") != "PasswordUpdated":
        return False

    # Only check root activity
    if event.deep_get("userIdentity", "type") != "Root":
        return False

    # Only alert if the login was a success
    return event.deep_get("responseElements", "PasswordUpdated") == "Success"


def alert_context(event):
    return aws_rule_context(event)