[AWS-SIGNIN] Successful User login without MFA

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SIGNIN] Successful User login without MFA"; program:signin.amazonaws.com; json_content:".eventName","ConsoleLogin"; json_content:".additionalEventData.MFAUsed","No"; json_content:".responseElements.ConsoleLogin","Success"; parse_src_ip:1; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; content: ! "AWSReservedSSO_AWSAdministratorAccess"; content: !"AWSServiceRole"; json_map:"username",".principalId"; threshold: type suppress, track by_src&byusername, count 1, seconds 3600; classtype:system-event; reference:url,aws.amazon.com/blogs/mt/analyzing-cloudtrail-in-cloudwatch/; sid:5014022; rev:4;)