LoFP LoFP / environments that do not enforce mfa for all iam users will see this regularly. this is a new terms rule, so it only fires once per `user.id` within the configured history window (7d); use it to drive mfa enrollment and enforcement rather than treating every occurrence as an incident, unless mfa is a mandated control in your environment.

Techniques

Sample rules

AWS IAM User Console Login Without MFA

Description

Identifies the first observed occurrence, within the configured New Terms history window, of a regular IAM user successfully signing in to the AWS Management Console without multi-factor authentication. A password alone is a weaker control than password-plus-MFA, and an adversary who has phished, guessed, or otherwise obtained a user’s password can sign in directly if MFA is not enforced for that user. This rule is scoped to standard IAM users only; it excludes the AWS root user (covered by a dedicated rule) and federated/SSO sign-ins (covered by a dedicated rule that also accounts for IdP-side MFA), since MFAUsed: No is expected in both of those cases for reasons unrelated to this gap.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "signin.amazonaws.com"
    and event.action: "ConsoleLogin"
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.type: "IAMUser"
    and aws.cloudtrail.console_login.additional_eventdata.mfa_used: false