Loading

AWS Sign-In Token Created

Captures requests to the AWS federation endpoint (signin.amazonaws.com) for GetSigninToken. This API exchanges existing temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is embedded in a one-click URL to the AWS Management Console. It is commonly used by custom federation tools and automation to pivot from programmatic access to a browser session. This is a building block rule meant to be used for correlation with other rules to detect suspicious activity.

Rule type: query
Rule indices:

  • filebeat-*
  • logs-aws.cloudtrail-*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: now-6m
Maximum alerts per execution: ?
References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS Sign-In
  • Use Case: Identity and Access Audit
  • Tactic: Initial Access
  • Rule Type: BBR

Version: ?
Rule authors:

  • Elastic

Rule license: Elastic License v2

event.dataset: "aws.cloudtrail" and
    event.provider: "signin.amazonaws.com" and
    event.action : "GetSigninToken" and
    event.outcome: "success"

Framework: MITRE ATT&CK