MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
- AWS Authentication From CrowdStrike Unmanaged Device (Panther)
- AWS Authentication from CrowdStrike Unmanaged Device (Panther)
- AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) (Panther)
- AWS EC2 Instance Console Login via Assumed Role (Elastic)
- AWS IAM User Console Login from Multiple Geolocations (Elastic)
- AWS IAM User Console Login Without MFA (Elastic)
- AWS Management Console Brute Force of Root User Identity (Elastic)
- AWS Management Console Root Login (Elastic)
Rule body
title: Console Login With MFA
id: dd9381d0-bde9-464d-ba68-dba31fe177e1
status: test
description: Detects a console login with MFA
references:
- https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/compromising-aws-console-credentials/
- https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/
- https://pages.awscloud.com/rs/112-TZM-766/images/Visibility_detect_respond_AWS_SANS_whitepaper.pdf
author: Zach Mathis (@yamatosecurity)
date: 2025-04-13
modified: 2025-04-13
tags:
- attack.initial-access
- attack.t1078 # Valid Accounts
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
additionalEventData.MFAUsed: 'Yes'
condition: selection
falsepositives:
level: informational
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
additionalEventData.MFAUsed: 'Yes'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
additionalEventData.MFAUsed | eq |
| field:"additionalEventData.MFAUsed" kind:eq value:"Yes" |
eventName | eq |
| field:"aws::eventName" kind:eq value:"ConsoleLogin" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"signin.amazonaws.com" |