{"id":"6393e346-1977-46ef-8987-ad414a145fad","title":"AWS ConsoleLogin Failed Authentication","description":"Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.\n","author":"Ivan Saakov, Nasreddine Bencherchali","status":"experimental","level":"medium","date":"2025-10-19","modified":"","tags":["attack.credential-access","attack.t1110"],"technique_ids":["T1110"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts."],"references":["https://naikordian.github.io/blog/posts/brute-force-aws-console/","https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm","https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml","source_sha256":"ca814c8cb7de0f11d39ad93a87bf1b58d70983111af806df58fc3bf1bb1689c1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS ConsoleLogin Failed Authentication\nid: 6393e346-1977-46ef-8987-ad414a145fad\nstatus: experimental\ndescription: |\n    Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.\nreferences:\n    - https://naikordian.github.io/blog/posts/brute-force-aws-console/\n    - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\n    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\nauthor: Ivan Saakov, Nasreddine Bencherchali\ndate: 2025-10-19\ntags:\n    - attack.credential-access\n    - attack.t1110\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventName: 'ConsoleLogin'\n        errorMessage: 'Failed authentication'\n    condition: selection\nfalsepositives:\n    - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"}],"data_path":"data/detection-rules/6393e346-1977-46ef-8987-ad414a145fad.json","kind":"sigma"}