[AWS-SIGNIN] Multiple Failed Console Login Attempts - Brute Force

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SIGNIN] Multiple Failed Console Login Attempts - Brute Force"; program:signin.amazonaws.com; json_content:".eventName","ConsoleLogin"; json_content:".responseElements.ConsoleLogin","Failure"; json_map:"src_ip",".sourceIPAddress"; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; after:track by_src, count 10, seconds 300; threshold:type suppress,track by_src,count 1, seconds 86400; xbits:set,brute-force,track ip_src,expire 28800; classtype:attempted-user; sid:5014083; rev:2; metadata:deployment Server,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_12_07, updated_at 2023_12_07, mitre_tactic_id TA0006, mitre_technique_id T1110;)