AWS ConsoleLogin without MFA triggered Impossible Travel scenario

cloudtrail

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect an Impossible Travel event when a @userIdentity.type: {{@userIdentity.type}} performs a consoleLogin without a multi-factor authentication (MFA) device.

Strategy

The Impossible Travel detection type’s algorithm compares the GeoIP data of the last log and the current log to determine if the user with @userIdentity.session_name: {{@userIdentity.session_name}} traveled more than 500km at over 1,000km/h and the account does not have MFA enabled.

Triage and response

  1. Determine if {{@userIdentity.session_name}} should be connecting from {{@impossible_travel.triggering_locations.first_location.city}}, {{@impossible_travel.triggering_locations.first_location.country}} and {{@impossible_travel.triggering_locations.second_location.city}}, {{@impossible_travel.triggering_locations.second_location.country}} in a short period of time.
  2. If the user should not be connecting from {{@impossible_travel.triggering_locations.first_location.city}}, {{@impossible_travel.triggering_locations.first_location.country}} and {{@impossible_travel.triggering_locations.second_location.city}}, {{@impossible_travel.triggering_locations.second_location.country}}, then consider isolating the account and reset credentials.
  3. Use the Cloud SIEM - User Investigation dashboard to audit any user actions that may have occurred after the illegitimate login.

Changelog

  • 30 September 2024 - Updated query to replace attribute @threat_intel.results.subcategory:anonymizer.