Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS Security Hub - Detect root user lacking MFA

This query detects AWS accounts where the root user does not have multi-factor authentication (MFA) enabled, using AWS Security Hub control IAM.9 findings. Lack of MFA on the root user increases the risk of unauthorized access and privilege abuse.

ATT&CK coverage

Outside the enterprise matrix

T1098Account Manipulation 272 detections cover this technique
T1110Brute Force 113 detections cover this technique
T1556.006Multi-Factor Authentication 27 detections cover this technique

Detection requirements

Log source product: awssecurityhub
Log source service: awssecurityhubfindings

What the source says

Tagged by the source as

CredentialAccessDefenseEvasionPersistencePrivilegeEscalation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.