AWS IAM User with Console Access Login Without MFA

calendar Oct 18, 2025 · attack.initial-access attack.t1078.004  ·
Share on: linkedin copy

Identifies AWS IAM user authentication to the AWS Management Console without Multi-Factor Authentication (MFA). IAM users who can access the Console but haven't enabled MFA pose a security risk. These accounts could be compromised through credential stuffing, brute force attacks, or social engineering techniques.

Sigma rule (View on GitHub)

 1title: AWS IAM User with Console Access Login Without MFA
 2id: 77caf516-34e5-4df9-b4db-20744fea0a60
 3status: experimental
 4description: |
 5    Identifies AWS IAM user authentication to the AWS Management Console without Multi-Factor Authentication (MFA).
 6    IAM users who can access the Console but haven't enabled MFA pose a security risk. These accounts could be compromised through credential stuffing, brute force attacks, or social engineering techniques.    
 7references:
 8    - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
 9    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
10author: Thuya@Hacktilizer
11date: 2025-10-18
12tags:
13    - attack.initial-access
14    - attack.t1078.004
15logsource:
16    product: aws
17    service: cloudtrail
18detection:
19    selection:
20        eventName: 'ConsoleLogin'
21        additionalEventData.MFAUsed: 'NO'
22    condition: selection
23falsepositives:
24    - Unlikely
25level: medium

References

Related rules

to-top