AWS Unusual Number of Failed Authentication Attempts from Same IP
This rule detects an unusual number of failed authentication attempts from the same IP address targeting valid users within an AWS environment. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail where the security result indicates a 'BLOCK' action due to 'Failed authentication'. The rule triggers if there are more than 5 distinct target users experiencing failed logins from the same IP within a 5-minute window. Additionally, it calculates a risk score based on whether the source IP's country of origin is associated with known high-risk geographies (Cuba, Iran, North Korea, Russia, Syria).
YARA-L
