Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
\\n 1title: AWS ConsoleLogin Failed Authentication\\n 2id: 6393e346-1977-46ef-8987-ad414a145fad\\n 3Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
\\n 1title: AWS ConsoleLogin Failed Authentication\\n 2id: 6393e346-1977-46ef-8987-ad414a145fad\\n 3status: experimental\\n 4description: |\\n 5 Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.\\n 6references:\\n 7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/\\n 8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\\n 9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\\n10author: Ivan Saakov, Nasreddine Bencherchali\\n11date: 2025-10-19\\n12tags:\\n13 - attack.credential-access\\n14 - attack.t1110\\n15logsource:\\n16 product: aws\\n17 service: cloudtrail\\n18detection:\\n19 selection:\\n20 eventName: 'ConsoleLogin'\\n21 errorMessage: 'Failed authentication'\\n22 condition: selection\\n23falsepositives:\\n24 - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.\\n25level: medium\\nDetects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
1title: AWS ConsoleLogin Failed Authentication
2id: 6393e346-1977-46ef-8987-ad414a145fad
3Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
1title: AWS ConsoleLogin Failed Authentication
2id: 6393e346-1977-46ef-8987-ad414a145fad
3status: experimental
4description: |
5 Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
6references:
7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/
8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
10author: Ivan Saakov, Nasreddine Bencherchali
11date: 2025-10-19
12tags:
13 - attack.credential-access
14 - attack.t1110
15logsource:
16 product: aws
17 service: cloudtrail
18detection:
19 selection:
20 eventName: ''ConsoleLogin''
21 errorMessage: ''Failed authentication''
22 condition: selection
23falsepositives:
24 - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.
25level: medium