Name:AWS High Number Of Failed Authentications From Ip id:f75b7f1a-b8eb-4975-a214-ff3e0a944757 version:3 date:2024-09-30 author:Bhavin Patel, Splunk status:production type:Anomaly Description:The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. This detection leverages CloudTrail logs, aggregating failed login events by IP address and time span. This activity is significant as it may indicate a brute force attack aimed at gaining unauthorized access or escalating privileges within an AWS environment. If confirmed malicious, this could lead to unauthorized access, data breaches, or further exploitation of AWS resources. Data_source:
-AWS CloudTrail ConsoleLogin
search:`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=5m _time | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id | where failed_attempts > 20 | `aws_high_number_of_failed_authentications_from_ip_filter`
how_to_implement:You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives:An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. References: -https://attack.mitre.org/techniques/T1110/003/ -https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ -https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ drilldown_searches: name:'View the detection results for - "$tried_accounts$"' search:'%original_detection_search% | search tried_accounts = "$tried_accounts$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$tried_accounts$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$tried_accounts$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'AWS Identity and Access Management Account Takeover' - 'Compromised User Account' asset_type:AWS Account confidence:90 impact:60 message:Multiple failed console login attempts (Count: $failed_attempts$) against users from IP Address - $src_ip$ mitre_attack_id: - 'T1110' - 'T1110.003' - 'T1110.004' observable: name:'tried_accounts' type:'User' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'user' - 'action' - 'eventName' - 'src_ip' risk_score:54 security_domain:threat
