AWS Root Console Login Password Spraying

  1[metadata]
  2creation_date = "2026/09/01"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/01"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies failed authentication attempts against the AWS Management Console root user from the same source IP address
 11targeting multiple AWS accounts. Password spraying uses few attempts per target across many accounts to avoid lockout,
 12making per-account volume an unreliable signal. This rule detects the cross-account breadth pattern: a single source IP
 13generating root ConsoleLogin failures across two or more distinct AWS accounts. Requires an AWS Organizations-level
 14CloudTrail trail aggregating events from member accounts.
 15"""
 16false_positives = [
 17    """
 18    Administrators behind a shared egress address, such as a corporate NAT gateway or VPN
 19    concentrator, can trigger this rule when separate people mistype root passwords for different
 20    accounts within the window, since a single failure per account is sufficient. An administrator
 21    who legitimately holds root credentials for several accounts can also match. Verify whether the
 22    source IP is an expected corporate or administrator address, and whether the targeted accounts
 23    correspond to that person's scope, before escalating. Repeated failures against a single account
 24    do not trigger this rule and are covered by the separate brute-force rule.
 25    """,
 26]
 27from = "now-1h"
 28index = ["logs-aws.cloudtrail-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "AWS Root Console Login Password Spraying"
 32note = """## Triage and analysis
 33
 34### Investigating AWS Root Console Login Password Spraying
 35
 36Password spraying is a credential access technique where an attacker tries a small number of commonly used or leaked passwords across many accounts. Unlike brute force, the per-account attempt count is intentionally low — often 2–8 attempts — to stay below lockout thresholds and evade high-volume detections. Attackers targeting AWS root accounts typically hold a pre-enumerated list of root account email addresses and route attempts through proxy or residential IP infrastructure.
 37
 38This rule fires when a single source IP generates failed root `ConsoleLogin` events against two or more distinct AWS accounts within a 1 hour window, requiring an AWS Organizations-level CloudTrail trail. The cross-account breadth is the defining spray signal; brute force against a single account is covered by a separate rule.
 39
 40#### Possible investigation steps
 41
 42- **Assess the source IP.**
 43Determine whether the IP belongs to a known corporate range, VPN, or expected admin location. Use threat intelligence tools to check if it is flagged as a proxy, Tor exit node, or residential proxy service.
 44
 45- **Review the user agent string.**
 46Outdated browser user agents (for example, Chrome 85 or Firefox 120) are common indicators of spray-campaign tooling. Cross-reference `user_agent.original` across the contributing events in Timeline.
 47
 48- **Check for a subsequent successful login.**
 49Query CloudTrail for a `ConsoleLogin` success for the root identity in the same timeframe. A success immediately after failures indicates the spray succeeded — escalate immediately.
 50
 51- **Examine follow-on API calls.**
 52If a successful login did occur, review high-risk API calls that followed: `CreateUser`, `CreateAccessKey`, `AttachRolePolicy`, `DeleteTrail`, or `StopLogging`.
 53
 54- **Widen the scope across accounts.**
 55If your organization uses AWS Organizations, check whether the same source IP triggered root login failures in other member accounts during the same window.
 56
 57### False positive analysis
 58
 59- **Mistyped credentials.** A root credential custodian mistyping the password multiple times is the most likely benign cause. Confirm whether the source IP is a known admin location and whether a successful login followed shortly after.
 60- **Stale automation.** Misconfigured scripts or browser sessions with cached root credentials may retry on failure. Check whether the user agent matches known internal tooling.
 61
 62### Response and remediation
 63
 64- **If no successful root login is found:**
 65  - Rotate the root password to a strong, unique credential stored in an offline vault.
 66  - Confirm MFA is enabled and enforced on the root account.
 67  - Block the source IP at AWS WAF or network ACLs if confirmed malicious.
 68
 69- **If a successful root login is found:**
 70  - Treat as Priority-1 account compromise and immediately follow the *AWS Management Console Root Login* investigation guide.
 71  - Initiate an emergency root password reset and MFA re-enrollment.
 72  - Preserve all CloudTrail events from ±1 hour around the login in an immutable evidence bucket.
 73  - Audit all API calls made during the session for persistence: new users, access keys, policy changes.
 74
 75### Additional information
 76
 77- [AWS root user best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html)
 78- [AWS IR Playbooks — Credential Compromise](https://github.com/aws-samples/aws-incident-response-playbooks)
 79"""
 80setup = """## Setup
 81
 82This rule requires an AWS Organizations-level CloudTrail trail that aggregates management events from all member accounts into a single destination. A single-account trail will only ever contain one `cloud.account.id` value and the cross-account cardinality signal will never fire.
 83
 84To configure an org-level trail: in the AWS CloudTrail console, create a trail scoped to your AWS Organization and enable it in all regions. Ensure the Elastic AWS integration is ingesting from the aggregated trail destination."""
 85references = [
 86    "https://securitylabs.datadoghq.com/articles/aws-root-user-bruteforce-campaign/",
 87]
 88risk_score = 47
 89rule_id = "171d3cdd-0c04-47c2-b392-65719284ae25"
 90severity = "medium"
 91tags = [
 92    "Domain: Cloud",
 93    "Domain: Identity",
 94    "Platform: AWS",
 95    "Data Source: AWS CloudTrail",
 96    "Use Case: Identity and Access Audit",
 97    "Tactic: Credential Access",
 98    "Rule Type: Threshold",
 99    "Resources: Investigation Guide",
100]
101timestamp_override = "event.ingested"
102type = "threshold"
103
104query = '''
105data_stream.dataset:aws.cloudtrail and
106event.provider:signin.amazonaws.com and
107event.action:ConsoleLogin and
108aws.cloudtrail.user_identity.type:Root and
109event.outcome:failure
110'''
111
112[rule.investigation_fields]
113field_names = [
114    "source.ip",
115    "user_agent.original",
116    "cloud.account.id",
117    "aws.cloudtrail.user_identity.type",
118    "event.outcome",
119    "aws.cloudtrail.error_message",
120    "@timestamp",
121]
122
123[[rule.threat]]
124framework = "MITRE ATT&CK"
125
126[[rule.threat.technique]]
127id = "T1110"
128name = "Brute Force"
129reference = "https://attack.mitre.org/techniques/T1110/"
130
131[[rule.threat.technique.subtechnique]]
132id = "T1110.003"
133name = "Password Spraying"
134reference = "https://attack.mitre.org/techniques/T1110/003/"
135
136[rule.threat.tactic]
137id = "TA0006"
138name = "Credential Access"
139reference = "https://attack.mitre.org/tactics/TA0006/"
140
141[rule.threshold]
142field = ["source.ip"]
143value = 1
144
145[[rule.threshold.cardinality]]
146field = "cloud.account.id"
147value = 2
148
149[rule.alert_suppression]
150duration = {value = 1, unit = "h"}