Elastic high stable kql

AWS Management Console Brute Force of Root User Identity

Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account.

View Source

Detection Logic

data_stream.dataset:aws.cloudtrail and 
event.provider:signin.amazonaws.com and 
event.action:ConsoleLogin and 
aws.cloudtrail.user_identity.type:Root and 
event.outcome:failure

False Positives

  • ⚠ Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives.

Field Validations

Loading…

Comments (0)

Loading comments...