Detection rules › Sigma
Failed Console Login
Detects failed console login attempts, which may indicate an attacker attempting to gain access to
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | No specific technique |
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
- AWS Authentication From CrowdStrike Unmanaged Device (Panther)
- AWS Authentication from CrowdStrike Unmanaged Device (Panther)
- AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) (Panther)
- AWS EC2 Instance Console Login via Assumed Role (Elastic)
- AWS IAM User Console Login from Multiple Geolocations (Elastic)
- AWS IAM User Console Login Without MFA (Elastic)
- AWS Management Console Brute Force of Root User Identity (Elastic)
- AWS Management Console Root Login (Elastic)
Rule body
title: Failed Console Login
id: 978c15f1-3468-42b2-bf0f-bb29ae6168cc
status: test
description: Detects failed console login attempts, which may indicate an attacker attempting to gain access to
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
- attack.initial_access
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
responseElements.ConsoleLogin: 'Failure'
condition: selection
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: signin.amazonaws.com
eventName: 'ConsoleLogin'
responseElements.ConsoleLogin: 'Failure'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"ConsoleLogin" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"signin.amazonaws.com" |
responseElements.ConsoleLogin | eq |
| field:"responseElements.ConsoleLogin" kind:eq value:"Failure" |