AWS CloudTrail GetSigninToken Requests with Suspected Console User-Agent
Flags CloudTrail GetSigninToken sign-in token requests with non-matching console user-agent patterns.
- Product
- aws
- Service
- cloudtrail
- Author
- Chester Le Bron (@123Le_Bron) (SigmaHQ), DRL 1.1
- Published
- 2024-02-26
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags AWS CloudTrail events where GetSigninToken is called against signin.amazonaws.com, excluding requests that match a specific Jersey-based user agent pattern. Attackers can use GetSigninToken to obtain temporary federated credentials that may help pivot from tooling to AWS console access while reducing reliance on MFA tied to an original identity. The detection relies on CloudTrail eventSource/eventName fields and the userAgent substring observed in the request.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS CloudTrail GetSigninToken Requests with Suspected Console User-Agent
id: 8dbc662b-5768-49de-b4a2-922f3e177e3c
status: test
description: This rule flags AWS CloudTrail events where GetSigninToken is called against signin.amazonaws.com, excluding requests that match a specific Jersey-based user agent pattern. Attackers can use GetSigninToken to obtain temporary federated credentials that may help pivot from tooling to AWS console access while reducing reliance on MFA tied to an original identity. The detection relies on CloudTrail eventSource/eventName fields and the userAgent substring observed in the request.
references:
- https://github.com/NetSPI/aws_consoler
- https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_console_getsignintoken.yml
author: Chester Le Bron (@123Le_Bron), Huntrule Team
date: 2024-02-26
tags:
- attack.lateral-movement
- attack.t1021.007
- attack.t1550.001
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: signin.amazonaws.com
eventName: GetSigninToken
filter_main_console_ua:
userAgent|contains: Jersey/${project.version}
condition: selection and not 1 of filter_main_*
falsepositives:
- GetSigninToken events will occur when using AWS SSO portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. Non-SSO configured roles would be abnormal and should be investigated.
level: medium
license: DRL-1.1
related:
- id: f8103686-e3e8-46f3-be72-65f7fcb4aa53
type: derived