Sigma rule: AWS ConsoleLogin Failed Authentication

Rule

Title

AWS ConsoleLogin Failed Authentication

Status

experimental

Level

medium

Author

Ivan Saakov, Nasreddine Bencherchali

Date

2025-10-19

File

rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventName: 'ConsoleLogin'
    errorMessage: 'Failed authentication'
condition: selection

False positives (as the rule lists them)

• Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.

Tags

• attack.credential-access
• attack.t1110

MITRE ATT&CK ids this rule names

• T1110

References

• https://naikordian.github.io/blog/posts/brute-force-aws-console/
• https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml