Detection rules › Splunk
AWS High Number Of Failed Authentications From Ip
The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. This detection leverages CloudTrail logs, aggregating failed login events by IP address and time span. This activity is significant as it may indicate a brute force attack aimed at gaining unauthorized access or escalating privileges within an AWS environment. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation of AWS resources.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110.003 Brute Force: Password Spraying, T1110.004 Brute Force: Credential Stuffing |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS Console Login (Panther)
- AWS Console Login Failed During MFA Challenge (Splunk)
- AWS ConsoleLogin Failed Authentication (Sigma)
- AWS CreateLoginProfile (Splunk)
- AWS Credential Access Failed Login (Splunk)
- AWS High Number Of Failed Authentications For User (Splunk)
- AWS Multiple Failed MFA Requests For User (Splunk)
- AWS Multiple Users Failing To Authenticate From Ip (Splunk)
Rule body splunk
name: AWS High Number Of Failed Authentications From Ip
id: f75b7f1a-b8eb-4975-a214-ff3e0a944757
version: 11
creation_date: '2023-01-30'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. This detection leverages CloudTrail logs, aggregating failed login events by IP address and time span. This activity is significant as it may indicate a brute force attack aimed at gaining unauthorized access or escalating privileges within an AWS environment. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation of AWS resources.
data_source:
- AWS CloudTrail ConsoleLogin
search: |-
`cloudtrail` eventName=ConsoleLogin action=failure
| bucket span=10m _time
| rename user_name as user
| stats dc(_raw) AS failed_attempts values(user) as user values(user_agent) as user_agent
BY _time, src, signature,
dest, vendor_account vendor_region,
vendor_product
| where failed_attempts > 20
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_high_number_of_failed_authentications_from_ip_filter`
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
drilldown_searches:
- name: View the detection results for - "$src$"
search: '%original_detection_search% | search src = "$src$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
intermediate_findings:
entities:
- field: user
type: user
score: 20
message: 'Multiple failed console login attempts (Count: $failed_attempts$) against users from IP Address - $src$'
analytic_story:
- AWS Identity and Access Management Account Takeover
- Compromised User Account
asset_type: AWS Account
mitre_attack_id:
- T1110.003
- T1110.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: cloud
security_domain: threat
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
source: aws_cloudtrail
sourcetype: aws:cloudtrail
test_type: unit
Stages and Predicates
Stage 1: search
`cloudtrail` eventName=ConsoleLogin action=failure
Stage 2: bucket
| bucket span=10m _time
Stage 3: rename
| rename user_name as user
Stage 4: stats
| stats dc(_raw) AS failed_attempts values(user) as user values(user_agent) as user_agent
BY _time, src, signature,
dest, vendor_account vendor_region,
vendor_product
Stage 5: where
| where failed_attempts > 20
Stage 6: search
| `security_content_ctime(firstTime)`
Stage 7: search
| `security_content_ctime(lastTime)`
Stage 8: search
| `aws_high_number_of_failed_authentications_from_ip_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action | eq |
|
eventName | eq |
|
failed_attempts | gt |
|
sourcetype | eq |
|