AWS Console Login Without MFA
Dash が新機能を発表!インシデントマネジメント、Continuous Profiler など多数の機能が追加されました! Dash イベントで発表された新機能!
<  Back to rules search

AWS Console Login Without MFA

cloudtrail

Classification:

compliance

Framework:

cis-aws

Control:

cis-3.2

Set up the cloudtrail integration.

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Overview

Goal

Detect when any user logs in to your AWS console without multi-factor authentication.

Strategy

This rule monitors CloudTrail and detects when any @evt.name has a value of Console Login, and @additionalEventData.MFAUsed has a value of no.

Note: This rule ignores logins using SAML because 2FA is implemented on the IdP and not through AWS.

Triage & Response

  1. Reach out to the user to determine if the login was legitimate.
  2. If the login was legitimate, request that the user enables 2FA.
  3. If the login wasn’t legitimate, rotate the credentials.
  4. Review all user accounts to ensure MFA is enabled.

Note: There is a separate rule to detect Root Login without MFA.