AWS Successful Console Login Without MFA

experimentalmedium
Log-Quelle: aws · cloudtrailAutor Thuya@Hacktilizer, Ivan SaakovDatum 2025-10-18
01

Beschreibung

Was dies ist, in Kürze.

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

02

Tags

attack.initial-accessattack.persistenceattack.privilege-escalationattack.stealthattack.t1078.004
03

Regelquelle (YAML)

title: AWS Successful Console Login Without MFA
id: 77caf516-34e5-4df9-b4db-20744fea0a60
status: experimental
description: |
    Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
    This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
references:
    - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
author: Thuya@Hacktilizer, Ivan Saakov
date: 2025-10-18
modified: 2025-10-21
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'ConsoleLogin'
        additionalEventData.MFAUsed: 'NO'
        responseElements.ConsoleLogin: 'Success'
    condition: selection
falsepositives:
    - Unlikely
level: medium
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.