Detection rules › By event

AWS-signin

Event	Rules
ConsoleLogin	40
GetSigninToken	7
PasswordRecoveryRequested	1

ConsoleLogin

40 detection rules reference this event. View event page.

Sigma (6)

AWS ConsoleLogin Failed Authentication severity medium T1110
AWS Successful Console Login Without MFA severity medium T1078,T1078.004
Console Login With MFA severity informational T1078
Console Login Without MFA severity medium T1078
Failed Console Login severity low
Many Failed Logins severity high

Elastic (7)

AWS EC2 Instance Console Login via Assumed Role severity high T1021,T1021.007,T1078,T1078.004,T1550,T1550.001
AWS GetFederationToken Followed by Console Login via Federation Exchange severity high T1606
AWS IAM User Console Login from Multiple Geolocations severity medium T1078,T1078.004,T1539
AWS IAM User Console Login Without MFA severity medium T1078,T1078.004
AWS Management Console Brute Force of Root User Identity severity high T1110,T1110.001
AWS Management Console Root Login severity medium T1078,T1078.004
AWS Sign-In Console Login with Federated User severity medium T1078,T1078.004

Splunk (10)

AWS Console Login Failed During MFA Challenge severity medium T1586,T1586.003,T1621
AWS CreateLoginProfile severity medium T1136,T1136.003
AWS Credential Access Failed Login severity medium T1110,T1110.001,T1586,T1586.003
AWS High Number Of Failed Authentications For User severity low T1201
AWS High Number Of Failed Authentications From Ip severity low T1110,T1110.003,T1110.004
AWS Multiple Failed MFA Requests For User severity low T1586,T1586.003,T1621
AWS Multiple Users Failing To Authenticate From Ip severity low T1110,T1110.003,T1110.004
AWS Successful Console Authentication From Multiple IPs severity low T1535,T1586
AWS Successful Single-Factor Authentication severity medium T1078,T1078.004,T1586,T1586.003
AWS Unusual Number of Failed Authentications From Ip severity low T1110,T1110.003,T1110.004,T1586,T1586.003

Kusto (3)

AWSCloudTrail - Login to AWS Management Console without MFA severity low T1078
AWSCloudTrail - NRT Login to AWS Management Console without MFA severity low T1078
Failed AzureAD logons but success logon to AWS Console severity medium T1078,T1110

YARA-L (6)

AWS Console Login Without MFA severity low T1078,T1078.004
AWS High Number Of Unknown User Authentication Attempts severity low T1110,T1110.004
AWS Privilege Escalation Using IAM Login Profile severity low T1136,T1136.003
AWS Successful Console Authentication From Multiple IPs severity medium T1586
AWS Successful Login After Multiple Failed Attempts severity medium T1078
AWS Unusual Number Of Failed Authentication Attempts From The Same IP severity medium T1110,T1110.004

Panther (8)

AWS Authentication From CrowdStrike Unmanaged Device severity medium
AWS Authentication from CrowdStrike Unmanaged Device
AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table)
AWS Console Login severity informational
Failed Root Console Login severity high T1110
Logins Without MFA severity high T1078
Logins Without SAML severity high T1078
Root Console Login severity high T1078

GetSigninToken

7 detection rules reference this event. View event page.

Sigma (3)

Attempt To Get Signin Token severity medium T1078,T1078.004
AWS Console GetSigninToken Potential Abuse severity medium T1021,T1021.007,T1550,T1550.001
Get Signin Token severity high T1078,T1078.004

Elastic (3)

AWS EC2 Instance Console Login via Assumed Role severity high T1021,T1021.007,T1078,T1078.004,T1550,T1550.001
AWS GetFederationToken Followed by Console Login via Federation Exchange severity high T1606
AWS Sign-In Token Created severity low building block T1078,T1078.004,T1550,T1550.001

Panther (1)

AWS Console GetSigninToken Potential Abuse severity medium T1021.007,T1550.001

PasswordRecoveryRequested

1 detection rules reference this event. View event page.

Elastic (1)

AWS Sign-In Root Password Recovery Requested severity high T1078,T1078.004