AWS Verified Access anomalous failed authentication attempts by host

aws

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1199-trusted-relationship

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when access is denied to a host authenticating using AWS Verified Access.

Strategy

The anomaly detection generates a security signal when a host’s authentication failure requests deviates from its baseline.

For more information about the anomaly detection method, see Detect security threats with anomaly detection rules.

Triage and response

Determine if the host {{@host}} should have access.