AWS Console GetSigninToken Possible Misuse (via cloudtrail)

title: AWS Console GetSigninToken Possible Misuse (via cloudtrail)
id: 0db09ef2-1b62-5f2e-abb5-2bacac6c00f3
status: stable
description: This rule detects potentially anomalous events involving "GetSigninToken". An adversary using the "aws_consoler" tool can abuse this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.
references:
    - https://attack.mitre.org/techniques/T1550/001/
    - https://attack.mitre.org/techniques/T1021/007/
    - https://github.com/NetSPI/aws_consoler
    - https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
author: Huntrule Team
date: 2026-01-05
tags:
    - attack.lateral-movement
    - attack.t1021.007
    - attack.t1550.001
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'signin.amazonaws.com'
        eventName: 'GetSigninToken'
    filter_main_console_ua:
        userAgent|contains: 'Jersey/${project.version}'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium