cscli scenarios install crowdsecurity/aws-cis-benchmark-login-no-mfaDetects login without MFA to the AWS console (Section 3.2 of CIS AWS Foundation Benchmark 1.2.0 ).
1type: trigger2name: crowdsecurity/aws-cis-benchmark-login-no-mfa3description: "Detect login without MFA to the AWS console"4filter: |5 evt.Meta.log_type == 'aws-cloudtrail' &&6 evt.Meta.event_name == "ConsoleLogin" &&7 evt.Unmarshaled.cloudtrail.additionalEventData.MFAUsed != "Yes" &&8 evt.Unmarshaled.cloudtrail.userIdentity.type == "IAMUser" &&9 evt.Unmarshaled.cloudtrail.responseElements.ConsoleLogin == "Success"10labels:11 confidence: 312 spoofable: 013 classification:14 - attack.T155215 - attack.T1078.00416 label: "AWS Credential misuse"17 behavior: "cloud:unusual-activity"18 service: aws19 cti: false20 remediation: false21