{"id":"77caf516-34e5-4df9-b4db-20744fea0a60","title":"AWS Successful Console Login Without MFA","description":"Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).\nThis alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.\n","author":"Thuya@Hacktilizer, Ivan Saakov","status":"experimental","level":"medium","date":"2025-10-18","modified":"2025-10-21","tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1078.004"],"technique_ids":["T1078.004"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Unlikely"],"references":["https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/","https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml","source_sha256":"9246d0fb4e7db1523cb747affd80b9f108a95eccee90d1ae022e58cbe7255fb2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS Successful Console Login Without MFA\nid: 77caf516-34e5-4df9-b4db-20744fea0a60\nstatus: experimental\ndescription: |\n    Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).\n    This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.\nreferences:\n    - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/\n    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html\nauthor: Thuya@Hacktilizer, Ivan Saakov\ndate: 2025-10-18\nmodified: 2025-10-21\ntags:\n    - attack.initial-access\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1078.004\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventName: 'ConsoleLogin'\n        additionalEventData.MFAUsed: 'NO'\n        responseElements.ConsoleLogin: 'Success'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078.004","id":"T1078.004","name":"Cloud Accounts","page":"techniques/enterprise/T1078.004/"}],"data_path":"data/detection-rules/77caf516-34e5-4df9-b4db-20744fea0a60.json","kind":"sigma"}