Suspicious AWS Successful Console Login Without MFA (via cloudtrail)

title: Suspicious AWS Successful Console Login Without MFA (via cloudtrail)
id: 57b68c86-502b-5103-bfc9-3786d89ce262
status: stable
description: This rule detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be leveraged to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
references:
    - https://attack.mitre.org/techniques/T1078/004/
    - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
author: Huntrule Team
date: 2026-02-08
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'ConsoleLogin'
        additionalEventData.MFAUsed: 'NO'
        responseElements.ConsoleLogin: 'Success'
    condition: selection
falsepositives:
    - Unknown
level: medium