aws:cloudtrail ConsoleLogin
ConsoleLogin
- Log source
- AWS CloudTrail
- Host type
- AWS
- Tier, host type
- Minimum
- Techniques
- 4
- Rules depending on it
- Splunk 10, Elastic 5, Microsoft Sentinel 7
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| AWS account | Minimum |
Techniques it helps detect
Rules that depend on it
Splunk 10
- AWS Console Login Failed During MFA Challenge
- AWS CreateLoginProfile
- AWS Credential Access Failed Login
- AWS High Number Of Failed Authentications For User
- AWS High Number Of Failed Authentications From Ip
- AWS Multiple Failed MFA Requests For User
- AWS Multiple Users Failing To Authenticate From Ip
- AWS Successful Console Authentication From Multiple IPs
- AWS Successful Single-Factor Authentication
- AWS Unusual Number of Failed Authentications From Ip
Elastic 5
Microsoft Sentinel 7
- AWSCloudTrail - Login to AWS Management Console without MFA
- AWSCloudTrail - NRT Login to AWS Management Console without MFA
- Cross-Cloud Password Spray detection
- Failed AWS Console logons but success logon to AzureAD
- Failed AzureAD logons but success logon to AWS Console
- Successful AWS Console Login from IP Address Observed Conducting Password Spray
- Suspicious AWS console logins by credential access alerts