AWS CloudTrail GetSigninToken with suspicious console user agent

title: AWS CloudTrail GetSigninToken with suspicious console user agent
id: 8dbc662b-5768-49de-b4a2-922f3e177e3c
status: test
description: This rule flags AWS CloudTrail events where eventName is GetSigninToken from eventSource signin.amazonaws.com, excluding matches for a specific console-related user agent pattern. Attackers may use GetSigninToken to obtain temporary federated access that can facilitate session establishment and credential misuse, reducing visibility into the underlying compromised access key. The detection relies on AWS CloudTrail eventSource, eventName, and userAgent telemetry to identify potentially suspicious login-token activity.
references:
  - https://github.com/NetSPI/aws_consoler
  - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml
author: Chester Le Bron (@123Le_Bron), Huntrule Team
date: 2024-02-26
tags:
  - attack.lateral-movement
  - attack.t1021.007
  - attack.t1550.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: signin.amazonaws.com
    eventName: GetSigninToken
  filter_main_console_ua:
    userAgent|contains: Jersey/${project.version}
  condition: selection and not 1 of filter_main_*
falsepositives:
  - GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated.
level: medium
license: DRL-1.1
related:
  - id: f8103686-e3e8-46f3-be72-65f7fcb4aa53
    type: derived