SignalHunt
← All rules

AWS-3001

high

AWS Console Login Brute Force

Detects repeated failed AWS Management Console login attempts (CloudTrail ConsoleLogin events with errorMessage indicating failed authentication) against the same account/source IP within a short window.

T1110T1078.004

Detection logic

{
  "detection_type": "threshold",
  "selection": {
    "eventName": "ConsoleLogin",
    "responseElements.ConsoleLogin": "Failure"
  },
  "groupby": "sourceIPAddress",
  "timeframe_minutes": 10,
  "threshold": 5,
  "condition": "gte"
}

Log source: category=cloudtrail, product=aws · Event ID(s): ConsoleLogin

Required log fields

  • sourceIPAddress
  • userIdentity.arn
  • userIdentity.accountId
  • additionalEventData.MFAUsed

Enabling this in your environment

Where: CloudTrail console / Organizations trail

aws cloudtrail create-trail --name org-trail --is-multi-region-trail --include-global-service-events aws cloudtrail put-event-selectors --trail-name org-trail --event-selectors '[{"ReadWriteType":"All","IncludeManagementEvents":true}]'

ConsoleLogin events are only recorded if a CloudTrail trail with management events enabled exists and covers the region. For near-real-time alerting (not just S3-delivered logs), also enable CloudWatch Logs integration on the trail and build a metric filter on this event pattern.

False positives

  • Users behind a corporate NAT/VPN mistyping MFA repeatedly

References