Sigma rule: AWS Console GetSigninToken Potential Abuse

Rule

Title

AWS Console GetSigninToken Potential Abuse

Status

test

Level

medium

Author

Chester Le Bron (@123Le_Bron)

Date

2024-02-26

File

rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious events involving "GetSigninToken".
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventSource: 'signin.amazonaws.com'
    eventName: 'GetSigninToken'
filter_main_console_ua:
    userAgent|contains: 'Jersey/${project.version}'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated.

Tags

• attack.lateral-movement
• attack.t1021.007
• attack.t1550.001

MITRE ATT&CK ids this rule names

• T1021.007
• T1550.001

References

• https://github.com/NetSPI/aws_consoler
• https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml