Failed AWS Console logons but success logon to AzureAD

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to AWS Console. Uses that list to identify any successful Microsoft Entra ID logons from these IPs within the same timeframe.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	910124df-913c-47e3-a7cd-29e1643fa55e
Severity	Medium
Kind	Scheduled
Tactics	InitialAccess, CredentialAccess
Techniques	T1078, T1110
Required Connectors	AzureActiveDirectory, AWS
Source	View on GitHub

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules