Rule Info
Name
AWS Successful Console Login Without MFA
Author
Thuya@Hacktilizer, Ivan Saakov
Description
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Reference
Date
2025-10-18 00:00:00
Modified
2025-10-21 00:00:00
Id
77caf516-34e5-4df9-b4db-20744fea0a60
Tags
attack.initial-access attack.defense-evasion attack.persistence attack.privilege-escalation attack.t1078.004
Type
Community Rule
Link to Public Repo
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR