AWS Sign-In AWS-signin

4 operations, identified by eventName in the audit log.

eventName	Description
_catch_all	Catch-all entry for AWS-signin rules that match the service but not a specific eventName.
ConsoleLogin	Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.
GetSigninToken	Retrieves a sign-in token used to grant console access to a federated user via the AWS federation endpoint.
PasswordRecoveryRequested	Records a request to initiate the root account password recovery process.

_catch_all: AWS-signin (catch-all)

Service: AWS-signin

Description

Catch-all entry for AWS-signin rules that match the service but not a specific eventName.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

ConsoleLogin

Service: AWS-signin

Description

Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Provider_Name`	eq	`signin.amazonaws.com`	4 rules	elastic
`aws::eventName`	eq	`ConsoleLogin`	4 rules	kusto, panther, sigma, splunk
`aws::eventSource`	eq	`signin.amazonaws.com`	4 rules	panther, sigma
`security_result.action`	eq	`ALLOW`	4 rules	chronicle
`security_result.action`	eq	`BLOCK`	3 rules	chronicle
`EventType`	eq	`ConsoleLogin`	3 rules	elastic
`event.outcome`	eq	`success`	3 rules	elastic
`event.outcome`	eq	`failure`	1 rule	elastic
`aws::userIdentity.type`	eq	`Root`	2 rules	elastic, panther, sigma
`aws::userIdentity.type`	eq	`AssumedRole`	1 rule	elastic, kusto, panther, sigma
`responseElements.ConsoleLogin`	eq	`Failure`	2 rules	panther, sigma
`security_result.description`	eq	`Reason: Failed authentication`	2 rules	chronicle
`additionalEventData.MFAUsed`	eq	`Yes`	1 rule	panther, sigma, splunk
`user.id`	contains	`:i-`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Sigma #

Console Login With MFA source informational: Detects a console login with MFA
Console Login Without MFA source medium: Detects a console login without MFA
Failed Console Login source low: Detects failed console login attempts, which may indicate an attacker attempting to gain access to

Show 1 more (4 total)

Many Failed Logins source high: Detects multiple failed console login attempts, which may indicate an attacker attempting password guessing or password spraying. This rule can be evaded if the attacker uses a different source IP address for each login attempt, so you may want to not group by source IP address to detect that evasion. Also, you may want to group on user agents as well to reduce false positives, however, that will also make it easier to evade detection.

Elastic #

AWS Management Console Brute Force of Root User Identity source high: Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account.
AWS Management Console Root Login source medium: Identifies a successful login to the AWS Management Console by the Root user.
AWS Sign-In Console Login with Federated User source medium: Identifies when a federated user logs into the AWS Management Console. Federated users are typically given temporary credentials to access AWS services. If a federated user logs into the AWS Management Console without using MFA, it may indicate a security risk, as MFA adds an additional layer of security to the authentication process. However, CloudTrail does not record whether a Federated User utilized MFA as part of authentication — that MFA decision often occurs at a third-party IdP (e.g., Okta, Azure AD, Google). As a result, CloudTrail fields such as MFAUsed / mfaAuthenticated appear as “No/false” for federated console logins even if IdP MFA was required. This alert should be correlated with IdP authentication logs to verify whether MFA was enforced for the session. Increase priority if you find a related "GetSigninToken" event whose source IP / ASN / geo or user-agent differs from the subsequent "ConsoleLogin" (possible token relay/abuse). Same-IP/UA pairs within a short window are more consistent with expected operator behavior and can be triaged with lower severity.

Show 1 more (4 total)

AWS EC2 Instance Console Login via Assumed Role source high: Detects successful AWS Management Console or federation login activity performed using an EC2 instance’s assumed role credentials. EC2 instances typically use temporary credentials to make API calls, not to authenticate interactively via the console. A successful "ConsoleLogin" or "GetSigninToken" event using a session pattern that includes "i-" (the EC2 instance ID) is highly anomalous and may indicate that an adversary obtained the instance’s temporary credentials from the instance metadata service (IMDS) and used them to access the console. Such activity can enable lateral movement, privilege escalation, or persistence within the AWS account.↳ also matches GetSigninToken

YARA-L #

AWS Console Login Without MFA source: Detect when a user logs into AWS console without MFA.
AWS High Number Of Unknown User Authentication Attempts source: Detects when a high number of failed authentication attempts happen for unknown users.
AWS Privilege Escalation Using IAM Login Profile source: Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.

Show 3 more (6 total)

AWS Successful Console Authentication From Multiple IPs source: Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
AWS Successful Login After Multiple Failed Attempts source: Detects successful login after multiple failed attempts
AWS Unusual Number Of Failed Authentication Attempts From The Same IP source: Detects unusual number of failed authentications from the same IP for valid users.

GetSigninToken

Service: AWS-signin

Description

Retrieves a sign-in token used to grant console access to a federated user via the AWS federation endpoint.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Provider_Name`	eq	`signin.amazonaws.com`	2 rules	elastic
`aws::eventName`	eq	`GetSigninToken`	1 rule	panther, sigma
`aws::eventSource`	eq	`signin.amazonaws.com`	1 rule	panther, sigma
`aws::userIdentity.type`	eq	`AssumedRole`	1 rule	elastic, kusto, panther, sigma
`user.id`	contains	`:i-`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Sigma #

AWS Console GetSigninToken Potential Abuse source medium: Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

Elastic #

AWS Sign-In Token Created source low: Captures requests to the AWS federation endpoint (signin.amazonaws.com) for GetSigninToken. This API exchanges existing temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is embedded in a one-click URL to the AWS Management Console. It is commonly used by custom federation tools and automation to pivot from programmatic access to a browser session. This is a building block rule meant to be used for correlation with other rules to detect suspicious activity.
AWS EC2 Instance Console Login via Assumed Role source high: Detects successful AWS Management Console or federation login activity performed using an EC2 instance’s assumed role credentials. EC2 instances typically use temporary credentials to make API calls, not to authenticate interactively via the console. A successful "ConsoleLogin" or "GetSigninToken" event using a session pattern that includes "i-" (the EC2 instance ID) is highly anomalous and may indicate that an adversary obtained the instance’s temporary credentials from the instance metadata service (IMDS) and used them to access the console. Such activity can enable lateral movement, privilege escalation, or persistence within the AWS account.↳ also matches ConsoleLogin

PasswordRecoveryRequested

Service: AWS-signin

Description

Records a request to initiate the root account password recovery process.

Fields #

Name	Description
`eventName`	The name of the API action that was called.
`eventSource`	The AWS service endpoint that received the request (e.g. iam.amazonaws.com).
`eventType`	CloudTrail event category: AwsApiCall, AwsConsoleSignIn, AwsConsoleAction, AwsServiceEvent, or AwsVpceEvents.
`userIdentity`	The IAM entity that made the request (type, principalId, arn, accountId, sessionContext).
`sourceIPAddress`	IP address of the caller, or the AWS service principal for service-initiated calls.
`awsRegion`	AWS Region the request was made to.
`requestParameters`	Parameters sent with the request. Shape is action-specific; null when none.
`responseElements`	Response elements. Shape is action-specific; null for reads or when absent.
`errorCode`	AWS service error code when the request failed. Absent on success.
`errorMessage`	Description of the error when errorCode is present.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Provider_Name`	eq	`signin.amazonaws.com`	1 rule	elastic

Detection Rules #

View all rules referencing this event →

Elastic #

AWS Sign-In Root Password Recovery Requested source high: Identifies a password recovery request for the AWS account root user. In AWS, the PasswordRecoveryRequested event from signin.amazonaws.com applies to the root user’s “Forgot your password?” flow. Other identity types, like IAM and federated users, do not generate this event. This alert indicates that someone initiated the root password reset workflow for this account. Verify whether this was an expected action and review identity provider notifications/email to confirm legitimacy.

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

AWS Sign-In AWS-signin

_catch_all: AWS-signin (catch-all)

Description

Fields #

ConsoleLogin

Description

Fields #

Common Indicators #

Detection Rules #

Sigma #

Elastic #

YARA-L #

GetSigninToken

Description

Fields #

Common Indicators #

Detection Rules #

Sigma #

Elastic #

PasswordRecoveryRequested

Description

Fields #

Common Indicators #

Detection Rules #

Elastic #

Keyboard shortcuts

Search operators