Failed AzureAD logons but success logon to AWS Console

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Identifies a list of IP addresses with a minimum number (defualt of 5) of failed logon attempts to Microsoft Entra ID. Uses that list to identify any successful AWS Console logons from these IPs within the same timeframe.

Attribute	Value
Type	Analytic Rule
Solution	Standalone Content
ID	643c2025-9604-47c5-833f-7b4b9378a1f5
Severity	Medium
Kind	Scheduled
Tactics	InitialAccess, CredentialAccess
Techniques	T1078, T1110
Required Connectors	AzureActiveDirectory, AzureActiveDirectory, AWS
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
AWSCloudTrail	EventName == "ConsoleLogin"	✓	✓	?

Associated Connectors

The following connectors provide data for this content item:

Connector	Solution
AWS	Amazon Web Services

Solutions: Amazon Web Services

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Analytic Rules