AWS High Number of Failed Console Login Attempts

This analytic identifies potential brute-force or password spraying attacks against AWS accounts. It focuses on detecting a high volume of failed console login attempts originating from a single IP address within a short timeframe. Specifically, it triggers when an IP exhibits 20 or more failed login attempts within a 5-minute window, as recorded in AWS CloudTrail logs. The activity is based on the eventName ConsoleLogin with a failure action. Successful exploitation could lead to unauthorized access to AWS resources, data breaches, and further malicious activity within the AWS environment. The detection is designed to identify and alert on suspicious authentication patterns that bypass normal security measures and represent a significant risk to AWS account security.

Attack Chain

1. Initial Access: The attacker attempts to gain initial access to the AWS environment by targeting the AWS Management Console login page.
2. Credential Guessing: The attacker initiates a password spraying or brute-force attack, attempting to authenticate with multiple usernames and passwords from a single IP address (T1110.003, T1110.004).
3. CloudTrail Logging: AWS CloudTrail logs each failed ConsoleLogin attempt, capturing the source IP address (src), username (user_name), and timestamp.
4. Log Aggregation: The security monitoring system collects and aggregates the CloudTrail logs.
5. Threshold Breach: The system identifies an IP address that exceeds the defined threshold of 20 failed login attempts within a 5-minute window.
6. Alert Trigger: An alert is generated, indicating a potential brute-force or password spraying attack.
7. Account Compromise (Potential): If the attacker successfully guesses valid credentials, they gain unauthorized access to the AWS account.
8. Lateral Movement/Data Exfiltration (Potential): Once inside the AWS environment, the attacker could potentially move laterally to access other resources or exfiltrate sensitive data.

Impact

A successful brute-force or password spraying attack can lead to complete compromise of the AWS account. This can result in unauthorized access to sensitive data, modification or deletion of critical resources, and financial losses due to resource abuse. The number of affected users and the extent of the damage will depend on the attacker's skill and the permissions associated with the compromised account. This type of attack may lead to compliance violations and reputational damage.

Recommendation

• Deploy the provided Sigma rule to your SIEM and tune the failed_attempts threshold and span duration based on your environment's baseline login activity.
• Investigate any triggered alerts by examining the source IP address (src) in the CloudTrail logs and correlate with other network activity.
• Enforce multi-factor authentication (MFA) on all AWS accounts to mitigate the risk of credential-based attacks.
• Monitor CloudTrail logs for other suspicious activities originating from the identified IP address.
• Implement account lockout policies to automatically disable accounts after a certain number of failed login attempts.