AWSCloudTrail - Multiple Failed Login Attempts Without MFA

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies repeated AWS Console login failures for identities without MFA, which may indicate password brute force activity against user accounts.

Attribute	Value
Type	Hunting Query
Solution	Amazon Web Services
ID	bf130d1d-702b-4af6-9528-8bc4229e59f4
Severity	High
Tactics	CredentialAccess
Techniques	T1110.001, T1110.004
Required Connectors	AWS
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
AWSCloudTrail	EventName == "ConsoleLogin"	✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Amazon Web Services