Many Failed Logins

Status: test
Severity: high
Time window: 5m
Log source: product aws, service cloudtrail
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

Detects multiple failed console login attempts, which may indicate an attacker attempting password guessing or password spraying. This rule can be evaded if the attacker uses a different source IP address for each login attempt, so you may want to not group by source IP address to detect that evasion. Also, you may want to group on user agents as well to reduce false positives, however, that will also make it easier to evade detection.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `ConsoleLogin`: Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.

Rules detecting the same action

These rules filter on the same operation.

AWS Authentication From CrowdStrike Unmanaged Device (Panther)
AWS Authentication from CrowdStrike Unmanaged Device (Panther)
AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) (Panther)
AWS EC2 Instance Console Login via Assumed Role (Elastic)
AWS IAM User Console Login from Multiple Geolocations (Elastic)
AWS IAM User Console Login Without MFA (Elastic)
AWS Management Console Brute Force of Root User Identity (Elastic)
AWS Management Console Root Login (Elastic)

Rule body


title: Many Failed Logins
id: 68f8de62-97cd-4a9a-afba-7804fddf43d4
status: test
description: |
    Detects multiple failed console login attempts, which may indicate an attacker attempting password guessing or password spraying.
    This rule can be evaded if the attacker uses a different source IP address for each login attempt, so you may want to not group by source IP address to detect that evasion.
    Also, you may want to group on user agents as well to reduce false positives, however, that will also make it easier to evade detection.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.initial_access
logsource:
    product: aws
    service: cloudtrail
correlation:
    type: event_count
    rules:
        - Failed Console Login
    group-by:
        - sourceIPAddress
    timespan: 5m
    condition:
        gte: 3
    generate: false
level: high
---
title: Failed Console Login
id: 978c15f1-3468-42b2-bf0f-bb29ae6168cc
status: test
description: Detects failed console login attempts, which may indicate an attacker attempting to gain access to
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.initial_access
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: signin.amazonaws.com
        eventName: 'ConsoleLogin'
        responseElements.ConsoleLogin: 'Failure'
    condition: selection
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: signin.amazonaws.com
    eventName: 'ConsoleLogin'
    responseElements.ConsoleLogin: 'Failure'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`ConsoleLogin`	`field:"aws::eventName" kind:eq value:"ConsoleLogin"`
`eventSource`	eq	`signin.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"signin.amazonaws.com"`
`responseElements.ConsoleLogin`	eq	`Failure`	`field:"responseElements.ConsoleLogin" kind:eq value:"Failure"`