Detection rules › Sigma
AWS Console GetSigninToken Potential Abuse
Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.007 Remote Services: Cloud Services, T1550.001 Use Alternate Authentication Material: Application Access Token |
Event coverage
| Provider | Event |
|---|---|
| AWS-signin | GetSigninToken |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS Console GetSigninToken Potential Abuse (Panther)
- AWS EC2 Instance Console Login via Assumed Role (Elastic)
- AWS Sign-In Token Created (Elastic)
Rule body yaml
title: AWS Console GetSigninToken Potential Abuse
id: f8103686-e3e8-46f3-be72-65f7fcb4aa53
status: test
description: |
Detects potentially suspicious events involving "GetSigninToken".
An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
references:
- https://github.com/NetSPI/aws_consoler
- https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
author: Chester Le Bron (@123Le_Bron)
date: 2024-02-26
tags:
- attack.lateral-movement
- attack.t1021.007
- attack.t1550.001
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'signin.amazonaws.com'
eventName: 'GetSigninToken'
filter_main_console_ua:
userAgent|contains: 'Jersey/${project.version}'
condition: selection and not 1 of filter_main_*
falsepositives:
- GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated.
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
eventSource: 'signin.amazonaws.com'
eventName: 'GetSigninToken'
Stage 2: not filter_main_console_ua
filter_main_console_ua:
userAgent|contains: 'Jersey/${project.version}'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
userAgent | match | Jersey/${project.version} |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
eventSource | eq |
|