AWS CloudTrail ConsoleLogin Failed authentication

Flags CloudTrail ConsoleLogin events with "Failed authentication" to help identify possible credential-based attacks.

FreeReviewedSigma · Medium · v5

Product: aws
Service: cloudtrail
Author: Ivan Saakov, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2025-10-19
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1110Brute Force
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies AWS CloudTrail events where an AWS ConsoleLogin attempt fails with the error message "Failed authentication". Such failures can indicate brute-force attempts or unauthorized access attempts against AWS account console access. It relies on CloudTrail telemetry containing the eventName and the authentication errorMessage fields.

Reporting behind it

Related detections9 linkedT1110 — drag to rearrange

Malicious SQL Server - Brutforce Enumeration with Non Existing Users - Login (via application)

Malicious Brutforce Enumeration with Non Existing Users - Login (via security)

Malicious Brutforce Enumeration on Windows OpenSSH Server with Non Existing User (via security)

Malicious Brutforce on Windows OpenSSH Server with Valid Users (via security)

Malicious RDP Discovery Performed on Multiple Hosts (via rdp)

Possible SonicWall Credential Testing via userLogin Endpoint

Malicious Brutforce Enumeration with Unexisting Users - Kerberos (via security)

Suspicious JumpCloud Password Brute Force Followed by Success

Bitbucket audit: User login failed authentication events

AWS CloudTrail ConsoleLogin Failed authentication

Pivot detection · T1110 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-consolelogin-failed-authentication-events-6393e346

title: AWS CloudTrail ConsoleLogin Failed authentication
id: b0e87e2e-f83a-4098-9cc4-6129ee63ccaf
status: experimental
description: This rule identifies AWS CloudTrail events where an AWS ConsoleLogin attempt fails with the error message "Failed authentication". Such failures can indicate brute-force attempts or unauthorized access attempts against AWS account console access. It relies on CloudTrail telemetry containing the eventName and the authentication errorMessage fields.
references:
  - https://naikordian.github.io/blog/posts/brute-force-aws-console/
  - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml
author: Ivan Saakov, Nasreddine Bencherchali, Huntrule Team
date: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1110
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: ConsoleLogin
    errorMessage: Failed authentication
  condition: selection
falsepositives:
  - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.
level: medium
license: DRL-1.1
related:
  - id: 6393e346-1977-46ef-8987-ad414a145fad
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL