LoFP LoFP / users may genuinely mistype or forget the password.

Techniques

Sample rules

AWS Credential Access Failed Login

Description

It shows that there have been an unsuccessful attempt to log in using the user identity to the AWS management console. Since the user identity has access to AWS account services and resources, an attacker might try to brute force the password for that identity.

Detection logic


| tstats count earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Authentication where Authentication.action = failure Authentication.app=AwsConsoleSignIn Authentication.signature=ConsoleLogin BY Authentication.app Authentication.signature Authentication.dest  Authentication.user Authentication.action Authentication.user_id Authentication.src 
| `drop_dm_object_name(Authentication)`  
| `security_content_ctime(firstTime)`
|  `security_content_ctime(lastTime)` 
| `aws_credential_access_failed_login_filter`