Suspicious Impossible Travel Logon - AWS
Last updated on:
In this page
About the rule
Rule Type
Advanced
Rule Description
Detects potential account compromise where the same AWS user authenticates to the Management Console from distinct geographic regions within an unrealistically short period. This behavior is often associated with credential theft or unauthorized session token use.
Severity
Critical
Rule Requirement
Criteria
e1:
actionname = "Successful logon"
| groupby CALLER
| groupby HOSTNAME having dcount(SOURCE_COUNTRY) > 1
| last 1 IPADDRESS
select e1.HOSTNAME, e1.CALLER, e1.HOSTNAME.IPADDRESS, e1.HOSTNAME.SOURCE_COUNTRY
Detection
Execution Mode
scheduled
Log Sources
AWS
