AWS Unusual Number of Failed Authentications From IP

This analytic identifies an unusual number of failed authentication attempts to the AWS Console originating from a single source IP address, targeting multiple valid user accounts. It leverages AWS CloudTrail logs and statistical analysis (3-sigma rule) to detect anomalies in failed login attempts. This behavior is indicative of a password spraying attack, where an adversary attempts to gain initial access or elevate privileges by trying a single password against many accounts. Successful exploitation could lead to unauthorized access, data breaches, or further compromise of the AWS environment.