AWS Root Console Login Password Spraying

Identifies failed authentication attempts against the AWS Management Console root user from the same source IP address targeting multiple AWS accounts. Password spraying uses few attempts per target across many accounts to avoid lockout, making per-account volume an unreliable signal. This rule detects the cross-account breadth pattern: a single source IP generating root ConsoleLogin failures across two or more distinct AWS accounts. Requires an AWS Organizations-level CloudTrail trail aggregating events from member accounts.

Rule type: threshold
Rule indices:

  • logs-aws.cloudtrail-*

Rule Severity: medium
Risk Score: 47
Runs every:
Searches indices from: now-1h
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: Identity
  • Platform: AWS
  • Data Source: AWS CloudTrail
  • Use Case: Identity and Access Audit
  • Tactic: Credential Access
  • Rule Type: Threshold
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires an AWS Organizations-level CloudTrail trail that aggregates management events from all member accounts into a single destination. A single-account trail will only ever contain one cloud.account.id value and the cross-account cardinality signal will never fire.

To configure an org-level trail: in the AWS CloudTrail console, create a trail scoped to your AWS Organization and enable it in all regions. Ensure the Elastic AWS integration is ingesting from the aggregated trail destination.

Password spraying is a credential access technique where an attacker tries a small number of commonly used or leaked passwords across many accounts. Unlike brute force, the per-account attempt count is intentionally low — often 2–8 attempts — to stay below lockout thresholds and evade high-volume detections. Attackers targeting AWS root accounts typically hold a pre-enumerated list of root account email addresses and route attempts through proxy or residential IP infrastructure.

This rule fires when a single source IP generates failed root ConsoleLogin events against two or more distinct AWS accounts within a 1 hour window, requiring an AWS Organizations-level CloudTrail trail. The cross-account breadth is the defining spray signal; brute force against a single account is covered by a separate rule.

  • Assess the source IP. Determine whether the IP belongs to a known corporate range, VPN, or expected admin location. Use threat intelligence tools to check if it is flagged as a proxy, Tor exit node, or residential proxy service.

  • Review the user agent string. Outdated browser user agents (for example, Chrome 85 or Firefox 120) are common indicators of spray-campaign tooling. Cross-reference user_agent.original across the contributing events in Timeline.

  • Check for a subsequent successful login. Query CloudTrail for a ConsoleLogin success for the root identity in the same timeframe. A success immediately after failures indicates the spray succeeded — escalate immediately.

  • Examine follow-on API calls. If a successful login did occur, review high-risk API calls that followed: CreateUser, CreateAccessKey, AttachRolePolicy, DeleteTrail, or StopLogging.

  • Widen the scope across accounts. If your organization uses AWS Organizations, check whether the same source IP triggered root login failures in other member accounts during the same window.

  • Mistyped credentials. A root credential custodian mistyping the password multiple times is the most likely benign cause. Confirm whether the source IP is a known admin location and whether a successful login followed shortly after.
  • Stale automation. Misconfigured scripts or browser sessions with cached root credentials may retry on failure. Check whether the user agent matches known internal tooling.

  • If no successful root login is found:

    • Rotate the root password to a strong, unique credential stored in an offline vault.
    • Confirm MFA is enabled and enforced on the root account.
    • Block the source IP at AWS WAF or network ACLs if confirmed malicious.

  • If a successful root login is found:

    • Treat as Priority-1 account compromise and immediately follow the AWS Management Console Root Login investigation guide.
    • Initiate an emergency root password reset and MFA re-enrollment.
    • Preserve all CloudTrail events from ±1 hour around the login in an immutable evidence bucket.
    • Audit all API calls made during the session for persistence: new users, access keys, policy changes.
data_stream.dataset:aws.cloudtrail and
event.provider:signin.amazonaws.com and
event.action:ConsoleLogin and
aws.cloudtrail.user_identity.type:Root and
event.outcome:failure

Framework: MITRE ATT&CK