Query: write Sigma for Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be u
Matching passage: Sigma rule: Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be u. Logsource: aws / cloudtrail. Rule: title: AWS Successful Console Login Without MFA id: 77caf516-34e5-4df9-b4db-20744fea0a60 status: experimental description: 'Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings. ' references: - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/ - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html author: Thuya@Hacktilizer, Ivan Saakov date: 2025-10-18 modified: 2025-10-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventName: ConsoleLogin additionalEventData.MFAUsed: 'NO' responseElements.ConsoleLogin: Success condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology fo. Logsource: windows / system. Rule: title: ISATAP Router Address Was Set id: d22df9cd-2aee-4089-93c7-9dc4eae77f2c status: experimental description: 'Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment. ' references: - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/ - https://redfoxsec.com/blog/ipv6-dns-takeover/ - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/ - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f author: hamid date: 2025-10-19 tags: - attack.impact - attack.credential-access - attack.collection - attack.initial-access - attack.privilege-escalation - attack.execution - attack.t1557 - attack.t1565.002 logsource: product: windows service: system detection: selection: EventID: 4100 Provider_Name: Microsoft-Windows-Iphlpsvc filter_main_localhost: IsatapRouter: - 127.0.0.1 - ::1 filter_optional_null: IsatapRouter: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate ISATAP router configuration in enterprise environments - IPv6 transition projects and network infrastructure changes - Network administrators configuring dual-stack networking - Automatic ISATAP configuration in some Windows deployments level: medium