cscli scenarios install crowdsecurity/aws-nwo-loginThis scenario needs the crowdsecurity/aws-cloudtrail parser and detects non working hours/days login in the aws console. You may want to adapt the hours to your specific needs. As an example, the scenario is written for UTC+2 working hours.
Following the https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html take an extra care of your cloudtrail region configuration when dealing with console signing event capture.
1# NWD/NWH AWS console login2type: trigger3name: crowdsecurity/aws-cloudtrail-nwo-nwd-console-login4description: "Detect console login outside of office hours"5filter: |6 evt.Meta.log_type == 'aws-cloudtrail' &&7 (evt.Meta.event_name == 'ConsoleLogin' || evt.Meta.event_name == 'GetSessionToken' || evt.Meta.event_name == 'GetFederationToken') &&8 evt.Unmarshaled.cloudtrail.responseElements?.ConsoleLogin == 'Success' &&9 (10 (evt.Time.Hour() >= 18 || evt.Time.Hour() < 6) ||11 (evt.Time.Weekday().String() == 'Saturday' || evt.Time.Weekday().String() == 'Sunday')12 )13groupby: evt.Meta.source_ip14scope:15 type: AwsARN16 expression: evt.Meta.user_arn17labels:18 confidence: 319 spoofable: 020 classification:21 - attack.T107822 behavior: "cloud:unusual-activity"23 label: "AWS bruteforce"24 service: aws25 cti: false26 remediation: false27