AWS Console Login Failed During MFA Challenge

name: AWS Console Login Failed During MFA Challenge
id: 55349868-5583-466f-98ab-d3beb321961e
version: 11
creation_date: '2022-10-03'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies failed authentication attempts to the AWS Console during the Multi-Factor Authentication (MFA) challenge. It leverages AWS CloudTrail logs, specifically the `additionalEventData` field, to detect when MFA was used but the login attempt still failed. This activity is significant as it may indicate an adversary attempting to access an account with compromised credentials but being thwarted by MFA. If confirmed malicious, this could suggest an ongoing attempt to breach the account, potentially leading to unauthorized access and further attacks if MFA is bypassed.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName= ConsoleLogin errorMessage="Failed authentication" additionalEventData.MFAUsed = "Yes"
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product additionalEventData.MFAUsed
           errorMessage
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_console_login_failed_during_mfa_challenge_filter`
how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs.
known_false_positives: Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
references:
    - https://attack.mitre.org/techniques/T1621/
    - https://aws.amazon.com/what-is/mfa/
finding:
    title: User $user$ failed to pass MFA challenge while logging into console from $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Compromised User Account
asset_type: AWS Account
mitre_attack_id:
    - T1586.003
    - T1621
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat