cscli scenarios install crowdsecurity/aws-bfThis scenario needs the crowdsecurity/aws-cloudtrail parser and detects bruteforce of the aws console
Following the https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html take an extra care of your cloudtrail region configuration when dealing with console signing event capture and please keep in mind that event successful and failed login attempts might not be sent in the same cloudtrail region.
Please keep in mind that only console signing regardind existing users are captured in cloudtrail. This makes this scenario useful for existing users and the root user.
1type: leaky2capacity: 53leakspeed: 30s4name: crowdsecurity/aws-cloudtrail-bf-console-login5description: "Detect console login bruteforce"6filter: |7 evt.Meta.log_type == 'aws-cloudtrail' && (8 (evt.Meta.event_name == 'ConsoleLogin' && evt.Unmarshaled.cloudtrail.responseElements.ConsoleLogin == 'Failure') ||9 (evt.Meta.event_name == 'GetSessionToken' && evt.Meta.error_code=='AccessDenied') ||10 (evt.Meta.event_name == 'GetFederationToken' && evt.Meta.error_code=='AccessDenied')11 )12groupby: evt.Meta.source_ip13blackhole: 1m14reprocess: true15scope:16 type: Ip17labels:18 confidence: 319 spoofable: 020 classification:21 - attack.T111022 behavior: "cloud:bruteforce"23 label: "AWS bruteforce"24 service: aws25 remediation: false26