detection.wiki

Detection rules › Panther

AWS Console GetSigninToken Potential Abuse

Status
Experimental
Severity
medium
Log types
AWS.CloudTrail
Tags
AWS, AWS STS, Lateral Movement:Remote Services, Defense Evasion:Use Alternate Authentication Material
Reference
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html
Source
github.com/panther-labs/panther-analysis

Detects GetSigninToken calls from non-SSO user agents. An adversary can use tools like aws_consoler to convert compromised CLI credentials into a federated console session, bypassing MFA requirements and obscuring the original access key. The GetSigninToken API creates temporary console access from STS temporary credentials.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.007 Remote Services: Cloud Services, T1550.001 Use Alternate Authentication Material: Application Access Token

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

AnalysisType: rule
Filename: aws_console_getsignintoken.py
RuleID: "AWS.Console.GetSigninToken.Abuse"
DisplayName: "AWS Console GetSigninToken Potential Abuse"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - AWS STS
  - Lateral Movement:Remote Services
  - Defense Evasion:Use Alternate Authentication Material
Reports:
  MITRE ATT&CK:
    - TA0008:T1021.007
    - TA0005:T1550.001
Status: Experimental
Severity: Medium
Description: >
  Detects GetSigninToken calls from non-SSO user agents. An adversary can use tools
  like aws_consoler to convert compromised CLI credentials into a federated console
  session, bypassing MFA requirements and obscuring the original access key. The
  GetSigninToken API creates temporary console access from STS temporary credentials.
Runbook: |
  1. Query CloudTrail for all API calls by userIdentity:arn in the 6 hours before and after this alert, focusing on ConsoleLogin and console-based actions that may indicate the federated session was used
  2. Check if sourceIPAddress and userAgent are associated with known internal tooling or if they match patterns of attacker tools like aws_consoler
  3. Find all other alerts from this userIdentity:accessKeyId in the past 7 days to determine if the underlying credentials are compromised
Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html
SummaryAttributes:
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Suspicious GetSigninToken
    ExpectedResult: true
    Log:
      {
        "awsRegion": "us-east-1",
        "eventName": "GetSigninToken",
        "eventSource": "signin.amazonaws.com",
        "eventTime": "2024-01-15T10:30:00Z",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
        "sourceIPAddress": "203.0.113.50",
        "userAgent": "python-requests/2.28.0",
        "userIdentity": {
          "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
          "accountId": "123456789012",
          "arn": "arn:aws:sts::123456789012:assumed-role/MyRole/session",
          "type": "AssumedRole"
        }
      }
  - Name: Legitimate SSO Portal GetSigninToken
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-east-1",
        "eventName": "GetSigninToken",
        "eventSource": "signin.amazonaws.com",
        "eventTime": "2024-01-15T10:30:00Z",
        "eventType": "AwsApiCall",
        "recipientAccountId": "123456789012",
        "sourceIPAddress": "10.0.0.1",
        "userAgent": "Jersey/${project.version}",
        "userIdentity": {
          "type": "AssumedRole",
          "arn": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_Admin/user@example.com"
        }
      }
  - Name: Unrelated Signin Event
    ExpectedResult: false
    Log:
      {
        "awsRegion": "us-east-1",
        "eventName": "ConsoleLogin",
        "eventSource": "signin.amazonaws.com",
        "eventTime": "2024-01-15T10:30:00Z",
        "eventType": "AwsConsoleSignIn",
        "recipientAccountId": "123456789012",
        "sourceIPAddress": "203.0.113.50",
        "userAgent": "Mozilla/5.0",
        "userIdentity": {
          "type": "IAMUser",
          "userName": "admin"
        }
      }

Detection logic

Condition

eventSource eq "signin.amazonaws.com"
eventName eq "GetSigninToken"
userAgent not contains "Jersey/${project.version}"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
userAgentcontainsJersey/${project.version}

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
eventNameeq
  • GetSigninToken
eventSourceeq
  • signin.amazonaws.com

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
eventName
eventSource
awsRegion
recipientAccountId
sourceIPAddress
userAgent
userIdentity
arnuserIdentity.arn