AWS CloudTrail ConsoleLogin failed authentication events

Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-consolelogin-failed-authentication-events-6393e346

title: AWS CloudTrail ConsoleLogin failed authentication events
id: b0e87e2e-f83a-4098-9cc4-6129ee63ccaf
status: experimental
description: This rule matches AWS CloudTrail events where the event name is ConsoleLogin and the error message is "Failed authentication". Such failures can indicate brute-force attempts or incorrect credentials being tried against AWS console access. The detection relies on CloudTrail authentication failure telemetry, specifically the ConsoleLogin event and its errorMessage field. Investigate repeated failures and validate whether any authorized users attempted logins from the affected source.
references:
  - https://naikordian.github.io/blog/posts/brute-force-aws-console/
  - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml
author: Ivan Saakov, Nasreddine Bencherchali, Huntrule Team
date: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: ConsoleLogin
    errorMessage: Failed authentication
  condition: selection
falsepositives:
  - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.
level: medium
license: DRL-1.1
related:
  - id: 6393e346-1977-46ef-8987-ad414a145fad
    type: derived

What it detects

This rule matches AWS CloudTrail events where the event name is ConsoleLogin and the error message is "Failed authentication". Such failures can indicate brute-force attempts or incorrect credentials being tried against AWS console access. The detection relies on CloudTrail authentication failure telemetry, specifically the ConsoleLogin event and its errorMessage field. Investigate repeated failures and validate whether any authorized users attempted logins from the affected source.

Known false positives

Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.