LoFP / users may genuinely mistype or forget the password.

Techniques

• T1110
• T1110.001
• T1586
• T1586.003

Sample rules

AWS Credential Access Failed Login

• source: splunk
• technicques:
  • T1586
  • T1586.003
  • T1110
  • T1110.001

Description

The following analytic identifies unsuccessful login attempts to the AWS Management Console using a specific user identity. It leverages AWS CloudTrail logs to detect failed authentication events associated with the AWS ConsoleLogin action. This activity is significant for a SOC because repeated failed login attempts may indicate a brute force attack or unauthorized access attempts. If confirmed malicious, an attacker could potentially gain access to AWS account services and resources, leading to data breaches, resource manipulation, or further exploitation within the AWS environment.

Detection logic

| tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure Authentication.app=AwsConsoleSignIn Authentication.signature=ConsoleLogin BY Authentication.app Authentication.signature Authentication.dest  Authentication.user Authentication.action Authentication.user_id Authentication.src 
| `drop_dm_object_name(Authentication)`  
| `security_content_ctime(firstTime)`
|  `security_content_ctime(lastTime)` 
| `aws_credential_access_failed_login_filter`