AWS CloudTrail ConsoleLogin success events where MFAUsed is NO

title: AWS CloudTrail ConsoleLogin success events where MFAUsed is NO
id: c0d8e4b3-4408-445c-8257-9b29510789ed
status: experimental
description: This rule flags successful AWS console sign-ins recorded in CloudTrail where MFAUsed is explicitly set to NO. Attackers who gain access to credentials may attempt to avoid multi-factor authentication to maintain stealth or persistence. The detection relies on CloudTrail telemetry fields for the ConsoleLogin event, MFAUsed, and the success response element.
references:
  - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml
author: Thuya@Hacktilizer, Ivan Saakov, Huntrule Team
date: 2025-10-18
modified: 2025-10-21
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: ConsoleLogin
    additionalEventData.MFAUsed: NO
    responseElements.ConsoleLogin: Success
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 77caf516-34e5-4df9-b4db-20744fea0a60
    type: derived