Name:AWS Multiple Users Failing To Authenticate From Ip id:71e1fb89-dd5f-4691-8523-575420de4630 version:3 date:2024-10-16 author:Bhavin Patel status:production type:Anomaly Description:The following analytic identifies a single source IP failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. It leverages CloudTrail logs to detect multiple failed login attempts from the same IP address. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain unauthorized access or elevate privileges by trying common passwords across many accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the AWS environment. Data_source:
-AWS CloudTrail ConsoleLogin
search:`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip | where unique_accounts>30 | `aws_multiple_users_failing_to_authenticate_from_ip_filter`
how_to_implement:You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives:No known false postives for this detection. Please review this alert References: -https://attack.mitre.org/techniques/T1110/003/ -https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ -https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ drilldown_searches: name:'View the detection results for - "$tried_accounts$"' search:'%original_detection_search% | search tried_accounts = "$tried_accounts$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$tried_accounts$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$tried_accounts$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' tags: analytic_story: - 'AWS Identity and Access Management Account Takeover' - 'Compromised User Account' asset_type:AWS Account confidence:90 impact:60 message:Multiple failed console login attempts (Count: $unique_accounts$) against users from IP Address - $src_ip$ mitre_attack_id: - 'T1110' - 'T1110.003' - 'T1110.004' observable: name:'src_ip' type:'IP Address' - role: - 'Attacker' name:'tried_accounts' type:'User' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'user' - 'action' - 'eventName' - 'src_ip' risk_score:54 security_domain:threat manual_test:This search needs a specific number of events in a time window for the alert to trigger and events split up in CI testing while updating timestamp.
