Sigma rule: AWS Console Login Monitoring

Rule

Title

AWS Console Login Monitoring

Status

experimental

Level

medium

Author

Ivan Saakov

Date

2025-10-19

File

rules-placeholder/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_from_susp_locations.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization.
This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventName: 'ConsoleLogin'
    responseElements.ConsoleLogin: 'Success'
filter_main_country:
    src_country|expand: '%Legitimate_Countries%' # Add legitimate countries here
filter_main_ip:
    src_ip|expand: '%Legitimate_IP_Ranges%' # Add legitimate src_ip ranges here
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate logins from trusted countries and IP addresses.
• Login through services hosted through cloud providers in other regions.

Tags

• attack.privilege-escalation
• attack.initial-access
• attack.persistence
• attack.stealth
• attack.t1078.004

MITRE ATT&CK ids this rule names

• T1078.004

References

• https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-placeholder/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_from_susp_locations.yml