1type: trigger
2name: crowdsecurity/aws-cis-benchmark-console-auth-fail
3description: "Detect AWS console authentication failure"
4filter: |
5  evt.Meta.log_type == 'aws-cloudtrail' && 
6  evt.Meta.event_name == "ConsoleLogin" && 
7  evt.Unmarshaled.cloudtrail.errorMessage == "Failed authentication"
8labels:
9  confidence: 3
10  spoofable: 0
11  classification:
12    - attack.T1110
13  behavior: "cloud:bruteforce"
14  label: "AWS bruteforce"
15  service: aws
16  remediation: false
17