splunk_escuTTP

AWS Credential Access Failed Login

The following analytic identifies unsuccessful login attempts to the AWS Management Console using a specific user identity. It leverages AWS CloudTrail logs to detect failed authentication events associated with the AWS ConsoleLogin action. This activity is significant for a SOC because repeated failed login attempts may indicate a brute force attack or unauthorized access attempts. If confirmed malicious, an attacker could potentially gain access to AWS account services and resources, leading to data breaches, resource manipulation, or further exploitation within the AWS environment.

MITRE ATT&CK

T1110.001 T1586.003

Detection Query

`cloudtrail` eventName = ConsoleLogin errorMessage="Failed authentication"
  | rename user_name as user
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `aws_credential_access_failed_login_filter`

Author

Gowthamaraj Rajendran, Bhavin Patel, Splunk

Created

2026-03-10

Data Sources

AWS CloudTrail ConsoleLogin

References

https://attack.mitre.org/techniques/T1110/001/

Tags

AWS Identity and Access Management Account Takeover

Raw Content

name: AWS Credential Access Failed Login
id: a19b354d-0d7f-47f3-8ea6-1a7c36434968
version: 9
date: '2026-03-10'
author: Gowthamaraj Rajendran, Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic identifies unsuccessful login attempts to the AWS Management Console using a specific user identity. It leverages AWS CloudTrail logs to detect failed authentication events associated with the AWS ConsoleLogin action. This activity is significant for a SOC because repeated failed login attempts may indicate a brute force attack or unauthorized access attempts. If confirmed malicious, an attacker could potentially gain access to AWS account services and resources, leading to data breaches, resource manipulation, or further exploitation within the AWS environment.
data_source:
    - AWS CloudTrail ConsoleLogin
search: |-
    `cloudtrail` eventName = ConsoleLogin errorMessage="Failed authentication"
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_credential_access_failed_login_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: Users may genuinely mistype or forget the password.
references:
    - https://attack.mitre.org/techniques/T1110/001/
drilldown_searches:
    - name: View the detection results for - "$user$"
      search: '%original_detection_search% | search  user = "$user$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$user$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: User $user$ has a login failure from IP $src$
    risk_objects:
        - field: user
          type: user
          score: 50
    threat_objects:
        - field: src
          type: ip_address
tags:
    analytic_story:
        - AWS Identity and Access Management Account Takeover
    asset_type: AWS Account
    mitre_attack_id:
        - T1110.001
        - T1586.003
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: threat
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
          source: aws_cloudtrail
          sourcetype: aws:cloudtrail