Anvilogic high experimental other

AWS Failed Console Login [snowflake-awscloudtrail]

Adversaries may attempt to gain access to the AWS console by logging in with guessed or recovered credentials. -- Threat Actor Association: LUCR-3

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_name = 'ConsoleLogin' and response ilike '%Failure%'

Field Validations

Loading…

Comments (0)

Loading comments...