AWS ConsoleLogin Failed Authentication

Status: experimental
Severity: medium
Log source: product aws, service cloudtrail
Author: Ivan Saakov, Nasreddine Bencherchali
Source: github.com/SigmaHQ/sigma

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

Known false positives

Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1110` Brute Force

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `ConsoleLogin`: Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.

Rules detecting the same action

These rules filter on the same operation.

AWS Console Login (Panther)
AWS Console Login Failed During MFA Challenge (Splunk)
AWS CreateLoginProfile (Splunk)
AWS Credential Access Failed Login (Splunk)
AWS High Number Of Failed Authentications For User (Splunk)
AWS High Number Of Failed Authentications From Ip (Splunk)
AWS Multiple Failed MFA Requests For User (Splunk)
AWS Multiple Users Failing To Authenticate From Ip (Splunk)

Rule body

title: AWS ConsoleLogin Failed Authentication
id: 6393e346-1977-46ef-8987-ad414a145fad
status: experimental
description: |
    Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
references:
    - https://naikordian.github.io/blog/posts/brute-force-aws-console/
    - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
    - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
author: Ivan Saakov, Nasreddine Bencherchali
date: 2025-10-19
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'ConsoleLogin'
        errorMessage: 'Failed authentication'
    condition: selection
falsepositives:
    - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventName: 'ConsoleLogin'
    errorMessage: 'Failed authentication'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorMessage`	eq	`Failed authentication`	`field:"aws::errorMessage" kind:eq value:"Failed authentication"`
`eventName`	eq	`ConsoleLogin`	`field:"aws::eventName" kind:eq value:"ConsoleLogin"`