This rule detects password-spraying against AWS root accounts by correlating failed ConsoleLogin events from a single source IP across multiple AWS member accounts within a 1-hour window, requiring an organization-level CloudTrail trail to aggregate events. It uses CloudTrail data where event.provider = signin.amazonaws.com, event.action = ConsoleLogin, aws.cloudtrail.user_identity.type = Root, and event.outcome = failure. The detection is triggered when at least one source IP appears in failed root ConsoleLogin events across two or more distinct cloud accounts (i.e., cross-account breadth). This prioritizes cross-account breadth rather than per-account brute force, which is handled by a separate rule. The rule maps to MITRE ATT&CK: T1110 Brute Force, with subtechnique T1110.003 Password Spraying, and aligns with the Credential Access tactic (TA0006). It’s a threshold rule with a suppression window of 1 hour. Setup requires an AWS Organizations-level CloudTrail trail that aggregates management events from all member accounts; a single-account trail will not trigger the signal. Investigation context includes source IP, user agent, target account IDs, root login indicators, and potential error messaging. If a successful root login is observed in the same window, escalate as a potential compromise and review subsequent high-risk actions (e.g., CreateUser, CreateAccessKey, AttachRolePolicy, DeleteTrail, StopLogging), preserving relevant CloudTrail events. Remediation guidance includes rotating the root password, enforcing MFA, blocking the suspicious IP if confirmed malicious, and preserving evidence. False positives can arise from mistyped credentials by administrators sharing an egress address (NAT/VPN) or stale automation using cached credentials; such cases should be validated by confirming the source IP against known admin ranges and cross-account activity. The rule emphasizes cross-account breadth as the primary signal of password spraying against AWS root accounts and provides triage steps to confirm legitimacy or escalate.