Detection rules › Splunk
AWS Multiple Users Failing To Authenticate From Ip
The following analytic identifies a single source IP failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. It leverages CloudTrail logs to detect multiple failed login attempts from the same IP address. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain unauthorized access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1110.003 Brute Force: Password Spraying, T1110.004 Brute Force: Credential Stuffing |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS Console Login (Panther)
- AWS Console Login Failed During MFA Challenge (Splunk)
- AWS ConsoleLogin Failed Authentication (Sigma)
- AWS CreateLoginProfile (Splunk)
- AWS Credential Access Failed Login (Splunk)
- AWS High Number Of Failed Authentications For User (Splunk)
- AWS High Number Of Failed Authentications From Ip (Splunk)
- AWS Multiple Failed MFA Requests For User (Splunk)
Rule body splunk
name: AWS Multiple Users Failing To Authenticate From Ip
id: 71e1fb89-dd5f-4691-8523-575420de4630
version: 11
creation_date: '2022-09-26'
modification_date: '2026-05-13'
author: Bhavin Patel
status: production
type: Anomaly
description: The following analytic identifies a single source IP failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. It leverages CloudTrail logs to detect multiple failed login attempts from the same IP address. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain unauthorized access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment.
data_source:
- AWS CloudTrail ConsoleLogin
search: |-
`cloudtrail` eventName=ConsoleLogin action=failure
| bucket span=10m _time
| rename user_name as user
| stats dc(user) AS unique_accounts values(user) as user values(user_agent) as user_agent
BY _time, src, signature,
dest, vendor_account, vendor_region,
vendor_product
| where unique_accounts>30
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
known_false_positives: No known false postives for this detection. Please review this alert
references:
- https://attack.mitre.org/techniques/T1110/003/
- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
drilldown_searches:
- name: View the detection results for - "$user$"
search: '%original_detection_search% | search user = "$user$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$user$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
intermediate_findings:
entities:
- field: user
type: user
score: 20
message: 'Multiple failed console login attempts (Count: $unique_accounts$) against users from IP Address - $src$'
threat_objects:
- field: src
type: ip_address
analytic_story:
- AWS Identity and Access Management Account Takeover
- Compromised User Account
asset_type: AWS Account
mitre_attack_id:
- T1110.003
- T1110.004
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: cloud
security_domain: threat
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
source: aws_cloudtrail
sourcetype: aws:cloudtrail
description: PORTED MANUAL TEST - This search needs a specific number of events in a time window for the alert to trigger and events split up in CI testing while updating timestamp.
test_type: experimental
Stages and Predicates
Stage 1: search
`cloudtrail` eventName=ConsoleLogin action=failure
Stage 2: bucket
| bucket span=10m _time
Stage 3: rename
| rename user_name as user
Stage 4: stats
| stats dc(user) AS unique_accounts values(user) as user values(user_agent) as user_agent
BY _time, src, signature,
dest, vendor_account, vendor_region,
vendor_product
Stage 5: where
| where unique_accounts>30
Stage 6: search
| `security_content_ctime(firstTime)`
Stage 7: search
| `security_content_ctime(lastTime)`
Stage 8: search
| `aws_multiple_users_failing_to_authenticate_from_ip_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
action | eq |
|
eventName | eq |
|
sourcetype | eq |
|
unique_accounts | gt |
|