« AWS First Occurrence of STS GetFederationToken Request by User AWS GuardDuty Detection Suppression »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

AWS GetFederationToken Followed by Console Login via Federation Exchange

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS GetFederationToken Followed by Console Login via Federation Exchange

edit

Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was opened — all from the same source IP within two minutes. This sequence is a high-confidence indicator of credential abuse using stolen IAM access keys.

Rule type: eql

Rule indices:

  • logs-aws.cloudtrail-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Platform: AWS
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS CloudTrail
  • Service: AWS STS
  • Service: AWS Sign-In
  • Rule Type: Event Correlation (EQL)
  • Tactic: Credential Access
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating AWS GetFederationToken Followed by Console Login via Federation Exchange

This rule detects the aws_consoler attack chain: an adversary exfiltrates a long-term IAM access key (AKIA* prefix), runs aws_consoler or equivalent tooling, which calls GetFederationToken to obtain temporary credentials and then exchanges them at the AWS federation endpoint (https://signin.amazonaws.com/federation) for a signed console URL. Opening that URL triggers a ConsoleLogin event from the same source IP, completing the sequence.

The source IP correlation distinguishes this pattern from coincidental federation activity: both the API call and the browser-based console login originate from the same attacker machine in automated tooling scenarios.

Possible investigation steps

  • Identify the IAM user from aws.cloudtrail.user_identity.arn in the first event and confirm whether this user and access key are expected to call GetFederationToken.
  • Review source.ip against known infrastructure. A call from an unexpected geography or cloud provider IP range is a strong indicator of exfiltrated key abuse.
  • Query CloudTrail for all API calls made during the resulting console session (user identity type FederatedUser) in the window following the ConsoleLogin.
  • Check GitHub, GitLab, CI/CD pipelines, and .env files for exposure of the access key.
  • Determine whether any sensitive resources were accessed or modified during the console session.

Response and remediation

  • Immediately deactivate the long-term access key used in the GetFederationToken call.
  • Revoke all active sessions for the IAM user.
  • Review all actions taken during the federated console session and assess blast radius.
  • Rotate all credentials associated with the IAM user.
  • Migrate any legitimate federation use cases to IAM Identity Center or AssumeRoleWithWebIdentity.

Setup

edit

The AWS integration must be ingesting management events into logs-aws.cloudtrail-*. STS and sign-in management events are logged by default.

Rule query

edit
sequence by source.ip with maxspan=2m
  [any where event.provider == "sts.amazonaws.com"
   and event.action == "GetFederationToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "GetSigninToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "ConsoleLogin"
   and event.outcome == "success"]

Framework: MITRE ATT&CKTM

« AWS First Occurrence of STS GetFederationToken Request by User AWS GuardDuty Detection Suppression »