AWS Cloudtrail - Excessive Failed Logins on AWS Console

The rule detects excessive login failures in AWS console.

Check the pattern on which the attempts were made - Timelines and user names.

Check if the User has done any password reset in last 24 hours or beyond.

Verify if the Login failure is observed from same source IP or different IP

Check from which Source IP the logins are getting attempted. - External or Internal IP.

If external - From the identified source address, check for the reputation of the source address from various open source TI sites(Virustotal,MX Toolbox,Abuse IP DB), check for the historical threat association ,geolocation details of the identified external source address

If internal IP address, check what the logs shows about this system over last 24 hours and last 7 days.

Record the User being used for brute force logins

Understand the User role and privileges

Check for historical details of what type of actions the user who logged in does normally. Check his actions for the last 24 hours and then extend the time based on context.

Monitor if the action is first time activity by user account or was it executed in the past by running the query for last 7 days and extend the time frame if needed

Check with the user. Is this the user doing this or somebody else who has got credential access.

Look if similar alerts were observed for different username from same source IP

Check if the user account has been locked out after multiple failed attempts.

Verify if failed logon has occurred followed by a successful logon.

Check on the pattern of login failure traffic coming. Especially the time intervals.

Check if these events were triggered from a logon script, request the team to validated and confirm if the correct credentials are updated

If the Public IP used is malicious or not an recognized IP request to block the IP at firewall

If this was an unexpected activity kindly reset the account credentials by following strong password policy

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html#cloudtrail-aws-console-sign-in-events-iam-user-failure