AWS GetFederationToken Followed by Console Login via Federation Exchange

  1[metadata]
  2creation_date = "2026/08/14"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated
 11long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken
 12obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token
 13via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was
 14opened — all from the same source IP within two minutes. This sequence is a high-confidence
 15indicator of credential abuse using stolen IAM access keys.
 16"""
 17false_positives = [
 18    """
 19    Legacy federation broker applications that call GetFederationToken and immediately redirect
 20    users to a console session from the same host may trigger this rule. Validate the source IP
 21    against known application server infrastructure and confirm the federation architecture is
 22    documented.
 23    """,
 24]
 25from = "now-6m"
 26index = ["logs-aws.cloudtrail-*"]
 27language = "eql"
 28license = "Elastic License v2"
 29name = "AWS GetFederationToken Followed by Console Login via Federation Exchange"
 30note = """## Triage and analysis
 31
 32### Investigating AWS GetFederationToken Followed by Console Login via Federation Exchange
 33
 34This rule detects the aws_consoler attack chain: an adversary exfiltrates a long-term IAM access key (AKIA* prefix), runs aws_consoler or equivalent tooling, which calls `GetFederationToken` to obtain temporary credentials and then exchanges them at the AWS federation endpoint (`https://signin.amazonaws.com/federation`) for a signed console URL. Opening that URL triggers a `ConsoleLogin` event from the same source IP, completing the sequence.
 35
 36The source IP correlation distinguishes this pattern from coincidental federation activity: both the API call and the browser-based console login originate from the same attacker machine in automated tooling scenarios.
 37
 38### Possible investigation steps
 39
 40- Identify the IAM user from `aws.cloudtrail.user_identity.arn` in the first event and confirm whether this user and access key are expected to call `GetFederationToken`.
 41- Review `source.ip` against known infrastructure. A call from an unexpected geography or cloud provider IP range is a strong indicator of exfiltrated key abuse.
 42- Query CloudTrail for all API calls made during the resulting console session (user identity type `FederatedUser`) in the window following the `ConsoleLogin`.
 43- Check GitHub, GitLab, CI/CD pipelines, and `.env` files for exposure of the access key.
 44- Determine whether any sensitive resources were accessed or modified during the console session.
 45
 46### Response and remediation
 47
 48- Immediately deactivate the long-term access key used in the `GetFederationToken` call.
 49- Revoke all active sessions for the IAM user.
 50- Review all actions taken during the federated console session and assess blast radius.
 51- Rotate all credentials associated with the IAM user.
 52- Migrate any legitimate federation use cases to IAM Identity Center or AssumeRoleWithWebIdentity.
 53"""
 54references = [
 55    "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html",
 56    "https://github.com/NetSPI/aws_consoler",
 57    "https://www.netspi.com/blog/technical-blog/cloud-pentesting/gaining-aws-console-access-via-api-keys/",
 58    "https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/accessing-the-aws-console-with-getfederationtoken/"
 59]
 60risk_score = 73
 61rule_id = "065a9a1b-9e48-45a1-8fa5-72373245847c"
 62setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. STS and sign-in management events are logged by default."
 63severity = "high"
 64tags = [
 65    "Domain: Cloud",
 66    "Platform: AWS",
 67    "Data Source: AWS",
 68    "Data Source: Amazon Web Services",
 69    "Data Source: AWS CloudTrail",
 70    "Service: AWS STS",
 71    "Service: AWS Sign-In",
 72    "Rule Type: Event Correlation (EQL)",
 73    "Tactic: Credential Access",
 74    "Resources: Investigation Guide",
 75]
 76timestamp_override = "event.ingested"
 77type = "eql"
 78
 79query = '''
 80sequence by source.ip with maxspan=2m
 81  [any where event.provider == "sts.amazonaws.com"
 82   and event.action == "GetFederationToken"
 83   and event.outcome == "success"]
 84  [any where event.provider == "signin.amazonaws.com"
 85   and event.action == "GetSigninToken"
 86   and event.outcome == "success"]
 87  [any where event.provider == "signin.amazonaws.com"
 88   and event.action == "ConsoleLogin"
 89   and event.outcome == "success"]
 90'''
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94[[rule.threat.technique]]
 95id = "T1606"
 96name = "Forge Web Credentials"
 97reference = "https://attack.mitre.org/techniques/T1606/"
 98
 99[rule.threat.tactic]
100id = "TA0006"
101name = "Credential Access"
102reference = "https://attack.mitre.org/tactics/TA0006/"
103
104[rule.investigation_fields]
105field_names = [
106    "@timestamp",
107    "aws.cloudtrail.user_identity.arn",
108    "aws.cloudtrail.user_identity.type",
109    "aws.cloudtrail.user_identity.access_key_id",
110    "user.name",
111    "event.provider",
112    "event.action",
113    "event.outcome",
114    "source.ip",
115    "source.as.organization.name",
116    "cloud.region",
117    "cloud.account.id",
118]