[ { "fingerprint": "c392b42", "id": "UybWZO8Gre9MphC4ZSsEQwKCOEGrCNXcYdJXbwlpiMI=_19a0d0d8f78:497f7ef:752f71fa", "language": "en", "originId": "https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/", "origin": { "streamId": "feed/https://detection.fyi/index.xml", "title": "Detection.FYI", "htmlUrl": "https://detection.fyi/" }, "title": "AWS ConsoleLogin Failed Authentication", "published": 1761136602000, "crawled": 1761155583864, "summary": { "content": "Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.", "direction": "ltr" }, "alternate": [ { "href": "https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/", "type": "text/html" } ], "canonicalUrl": "https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/", "snippet": "\n

Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.

 1title: AWS ConsoleLogin Failed Authentication\n 2id: 6393e346-1977-46ef-8987-ad414a145fad\n 3

", "originContentType": "text/html", "fullContent": "\n

 1title: AWS ConsoleLogin Failed Authentication\n 2id: 6393e346-1977-46ef-8987-ad414a145fad\n 3status: experimental\n 4description: |\n 5  Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.\n 6references:\n 7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/\n 8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\n 9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\n10author: Ivan Saakov, Nasreddine Bencherchali\n11date: 2025-10-19\n12tags:\n13 - attack.credential-access\n14 - attack.t1110\n15logsource:\n16 product: aws\n17 service: cloudtrail\n18detection:\n19 selection:\n20 eventName: 'ConsoleLogin'\n21 errorMessage: 'Failed authentication'\n22 condition: selection\n23falsepositives:\n24 - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.\n25level: medium\n

", "unread": true, "categories": [ { "id": "enterprise/christeam/category/a1b9d077-7806-4b29-8f1c-d17ebc172ea3", "label": "AI: Ad-Hoc Research" } ], "commonTopics": [ { "type": "detectionRule", "label": "Sigma rules", "id": "nlp/f/topic/7010", "score": 1, "salienceLevel": "about" } ], "entities": [ { "type": "org", "disambiguated": true, "label": "Amazon Web Services", "id": "nlp/f/entity/gz:org:amazon-web-services", "mentions": [ { "text": "AWS" } ], "salienceLevel": "about" }, { "type": "mitreAttack", "disambiguated": true, "label": "Brute Force (Enterprise T1110)", "id": "nlp/f/entity/gz:mi:attack-pattern-a93494bb-4b80-4ea1-8695-3236a49916fd", "mentions": [ { "text": "brute-force" }, { "text": "t1110" } ], "salienceLevel": "mention" }, { "type": "mitreAttack", "disambiguated": true, "label": "Credential Access (Enterprise TA0006)", "id": "nlp/f/entity/gz:mi:x-mitre-tactic-2558fd61-8c75-4730-94c4-11926db2a263", "causes": [ { "label": "Brute Force (Enterprise T1110)", "id": "nlp/f/entity/gz:mi:attack-pattern-a93494bb-4b80-4ea1-8695-3236a49916fd" } ], "mentions": [ { "text": "credential-access" } ], "salienceLevel": "mention" }, { "type": "mitreAttack", "disambiguated": true, "label": "Tactics and Techniques", "id": "nlp/f/entity/gz:mi-any", "causes": [ { "label": "Brute Force (Enterprise T1110)", "id": "nlp/f/entity/gz:mi:attack-pattern-a93494bb-4b80-4ea1-8695-3236a49916fd" }, { "label": "Credential Access (Enterprise TA0006)", "id": "nlp/f/entity/gz:mi:x-mitre-tactic-2558fd61-8c75-4730-94c4-11926db2a263" } ], "mentions": [], "salienceLevel": "mention" } ], "leoSummary": { "sentences": [] }, "indicatorsOfCompromise": { "mentions": [], "exports": [], "sigmaRules": { "count": 1, "url": "https://exports.feedly.com/sigma/sigma-342359ad452d13341f73665ef05c1f60.yaml" } }, "attackNavigator": { "url": "https://exports.feedly.com/attacks/a322aeb98ff575dbc66b638386190651/feedly-ai-aws-consolelogin-failed-authentication.json", "ttpCount": 1 }, "sources": [ { "streamId": "feed/https://feedly.com/f/alert/278c354e-67ae-4509-b708-a354b8a41f9c", "title": "Detection rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/225a0035-48b9-407b-b2bb-853f005cb2ce", "title": "Sigma Rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": false } }, { "streamId": "feed/https://feedly.com/f/alert/6f87a1f0-f3cc-4738-a006-11ee08d9347a", "title": "Detection Rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/0022a78d-2857-4f9a-b3d1-ed323bfd3265", "title": "PIR5.4 What new detection rules have been published?", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/2c25ced4-db7a-400b-a711-802391d9089e", "title": "Sigma rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": false } }, { "streamId": "feed/https://feedly.com/f/alert/78ab8692-fa50-4ed7-954c-fadc12cba288", "title": "MITRE Tactics", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/entity/gz:mi:x-mitre-tactic-2558fd61-8c75-4730-94c4-11926db2a263", "label": "Credential Access (Enterprise TA0006)", "type": "mitreAttack" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/6c001996-3191-4cfb-918f-7ad1482a8999", "title": "Detection Rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/d25940c2-348f-4f2f-8bcd-e1b9a4dcc990", "title": "Detection Rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/28239608-5466-42b5-bc81-c29166fd46a8", "title": "Sigma rules and hunting queries", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/af41b13b-f3a2-4cff-be47-b60f605a6c4c", "title": "Detection Rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/3579d95a-7561-4017-8744-5518b125f475", "title": "Troubleshooting", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/entity/gz:org:amazon-web-services", "label": "Amazon Web Services", "type": "org" } ], "isComplexFilter": true } }, { "streamId": "feed/https://feedly.com/f/alert/1bb46cb3-0465-4a06-aaf7-795b5d062aca", "title": "DT Rules", "feedlyFeedType": "WebAlert", "searchTerms": { "parts": [ { "id": "nlp/f/topic/7010", "label": "Sigma rules" } ], "isComplexFilter": true } } ] }, { "language": "en", "id": "9SoZXMyUC2YuPYM5lOZapZAqx/84/0Bi+Qgx7L3rclM=_186099a7824:d77052:6d2d67a6", "createdBy": { "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36", "application": "feedly" }, "origin": { "title": "The Cyber Express", "streamId": "feed/https://thecyberexpress.com/feed/", "htmlUrl": "https://thecyberexpress.com" }, "content": { "content": "

A BreachForums user under the alias IntelBroker claims to have posted the customer data of Verizon Communications on the forum. The threat actor has claimed to have access to a database of 7.5 million Verizon customer records. Verizon has verified the data on the request from The Cyber Express.

According to their initial review of this matter, the data appears to be obtained approximately two weeks ago when a Verizon vendor experienced a security breach, Verizon spokesperson Richard Young told The Cyber Express.
\n
“This vendor creates videos for Verizon to assist customers with billing-related questions. The vendor had access to customer first names, device types, and service plans. The vendor did not have access to Social Security numbers, credit card numbers, or other personally identifiable customer information,” Young said.
\n
We have severed this vendor’s access to our systems and suspended use of their services. Our review of this matter continues.”

Commonly known as Verizon, the American multinational telecommunications conglomerate is a corporate component of the Dow Jones Industrial Average. According to Statista, Verizon has a retail customer base of approximately 143 million subscribers in 2021.

“In January 2023, a database of 7.5 million customers belonging to the Verizon was stolen by hackers,” claimed the post by IntelBroker. A sample of the hashed data posted indicates mobile and online subscription details.

The post, made on Friday, had the link to download the entire data tranche. IntelBroker’s present avatar has been active on the forum since October 2022. Its previous targets include Autotrader, Volvo, Hilton Hotels, and AT&T.

$\"\"$

Verizon and data breaches

Independent researchers were analysing the sample data at the time of publishing this report. If the tranche turns out to be authentic, this would be the company’s second major data breach in the past 12 months.

Verizon in May 2022 confirmed a data breach where the full names, email addresses, corporate ID numbers, and phone numbers of Verizon employees were compromised. According to a report from Motherboard, the data was shared with the publication by the hacker who reached out to them.

The company popped up in cybersecurity news over a data breach five years before that.

In 2017, the telecommunication company conceded that the personal data of 6 million customers had been leaked online. The leak was caused by a misconfigured security setting on a cloud server, which was the result of “human error.

The data, which included customer phone numbers, names, and some PIN codes, was publicly available online due to a mistake made by NICE Systems, an Israel-based company that Verizon was working with to facilitate customer service calls.

The data of telecommunication users was collected over a period of six months, and Verizon closed the security hole on June 22.

Update: The article was updated on January 27, 2023, with confirmations, and analysis from Verizon.

", "direction": "ltr" }, "title": "Verizon Investigates Customer Data Breach, Says No PII Compromised", "author": "Editorial", "crawled": 1675198363684, "published": 1675198363684, "updated": 1675198363684, "alternate": [ { "href": "https://thecyberexpress.com/verizon-customer-data-for-sale-on-dark-web/" } ], "canonical": [ { "type": "text/html", "href": "https://thecyberexpress.com/verizon-customer-data-for-sale-on-dark-web/" } ], "visual": { "width": 746, "processor": "feedly-nikon-v3.1", "url": "https://i0.wp.com/thecyberexpress.com/wp-content/uploads/2023/01/verison.jpg?resize=746%2C373&is-pending-load=1#038;ssl=1", "height": 373, "contentType": "image/jpeg" }, "canonicalUrl": "https://thecyberexpress.com/verizon-customer-data-for-sale-on-dark-web/", "unread": false, "commonTopics": [ { "type": "topic", "id": "nlp/f/topic/3003", "label": "Cyber Security", "score": 1, "causes": [ { "id": "nlp/f/topic/4009", "label": "Cyber Attacks" } ], "salienceLevel": "about" }, { "type": "cyberEvent", "targets": [ { "text": "Verizon Communications", "id": "nlp/f/entity/gz:org:verizon", "confidence": 0.9280639886856079 } ], "id": "nlp/f/topic/4009", "label": "Cyber Attacks", "score": 0.998, "salienceLevel": "about" }, { "type": "technology", "id": "nlp/f/topic/2256", "label": "Tech", "score": 0.692, "salienceLevel": "about" }, { "type": "topic", "id": "nlp/f/topic/603", "label": "Cyber Crime", "score": 0.931, "salienceLevel": "about" }, { "type": "topic", "id": "nlp/f/topic/1025", "label": "Hacking", "score": 0.97, "salienceLevel": "about" }, { "type": "topic", "id": "nlp/f/topic/4004", "label": "Data Breach", "score": 0.997, "salienceLevel": "about" }, { "type": "industryTopic", "id": "nlp/f/topic/4027", "label": "Telecom Industry", "score": 1, "salienceLevel": "about" } ], "entities": [ { "disambiguated": true, "type": "org", "id": "nlp/f/entity/gz:org:verizon", "label": "Verizon", "salienceLevel": "about", "mentions": [ { "text": "Verizon Communications" }, { "text": "Verizon" } ] }, { "disambiguated": true, "type": "org", "id": "nlp/f/entity/gz:org:at-t", "label": "AT&T", "salienceLevel": "mention", "mentions": [ { "text": "AT&T" } ] }, { "disambiguated": true, "type": "org", "id": "nlp/f/entity/gz:org:hilton-worldwide", "label": "Hilton Worldwide", "salienceLevel": "mention", "mentions": [ { "text": "Hilton Hotels" } ] }, { "disambiguated": true, "type": "org", "id": "nlp/f/entity/gz:org:travel-and-hospitality-industry-companies", "label": "Travel & Hospitality Companies", "causes": [ { "id": "nlp/f/entity/gz:org:hilton-worldwide", "label": "Hilton Worldwide" } ], "salienceLevel": "mention", "mentions": [] }, { "disambiguated": true, "type": "org", "id": "nlp/f/entity/gz:org:telecom-industry-companies", "label": "Telecom Companies", "causes": [ { "id": "nlp/f/entity/gz:org:verizon", "label": "Verizon" }, { "id": "nlp/f/entity/gz:org:at-t", "label": "AT&T" } ], "salienceLevel": "about", "mentions": [] }, { "disambiguated": true, "type": "org", "id": "nlp/f/entity/gz:org:fortune-500-companies", "label": "Fortune 500 Companies", "causes": [ { "id": "nlp/f/entity/gz:org:verizon", "label": "Verizon" }, { "id": "nlp/f/entity/gz:org:at-t", "label": "AT&T" } ], "salienceLevel": "about", "mentions": [] } ], "leoSummary": { "sentences": [ { "text": "According to their initial review of this matter, the data appears to be obtained approximately two weeks ago when a Verizon vendor experienced a security breach, Verizon spokesperson Richard Young told The Cyber Express." }, { "text": "A BreachForums user under the alias IntelBroker claims to have posted the customer data of Verizon Communications on the forum." } ] }, "indicatorsOfCompromise": { "exports": [], "mentions": [] } } ]