Rule Info
Name
AWS Successful Console Login Without MFA
Author
Thuya@Hacktilizer, Ivan Saakov
Description
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Reference
Date
2025-10-18 00:00:00
Modified
2025-10-21 00:00:00
Id
77caf516-34e5-4df9-b4db-20744fea0a60
Tags
attack.initial-access attack.persistence attack.privilege-escalation attack.stealth attack.t1078.004
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #5966 from @nasbench - Update mitre tags to use attack v19
2026-04-29
Swachchhanda Shrawan Poudel
Merge PR #5533 from @swachchhanda000 - fix: github reported issues
2025-10-18
Scan your endpoints, forensic images or collected files with our portable scanner THOR