Skip to content

Commit 7e1f815

Browse files
imays11imays11
authored
[Rule Tuning][New BBR Rule] AWS Sign-In Token Creation and Console Login (#5197)
* [Rule Tuning][New BBR Rule] AWS Sign-In Token Creation and Console Login ### Tuning - "AWS Signin Single Factor Console Login with Federated User" Rule scope change and name change to match - This original rule description suggests that it was designed to capture console login sessions by a Federated User without the use of MFA. However, AWS does not capture MFA usage for Federated Users (only for Root and IAM users). Federated identities will often use 3rd party IDP apps like Okta to enforce MFA, that data is not captured in Cloudtrail. So, the fields `MFAUsed` of `mfaAuthenticated` will always show as False/No in Cloudtrail. - I changed the scope of this rule to simply capture Console Login by a Federated User. For security reasons this behavior should be correlated with 3rd party IDP data to ensure MFA was established by the identity requesting the Federated Console login. This is very low noise behavior both in telemetry and prod data. - added highlighted fields - edited investigation guide to align with scope change ### New BBR - `GetSigninToken` exchanges existing temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is embedded in a one-click URL to the AWS Management Console. - ConsoleLogin API often follows a `GetSignInToken` request in normal operations. However, suspicious circumstances like both requests coming from different IPs or geo locations might indicate some form of compromise and should be investigated. - This BBR rule is created to capture all successful `GetSigninToken` requests for any identity type. It can be used for further correlation with other rules or as an investigative/hunting rule during alert triage. * adding FederatedUser to query adding FederatedUser to query * changed ig title to match rule name changed ig title to match rule name * toml-lint
1 parent 5f60e21 commit 7e1f815

File tree

3 files changed

+218
-114
lines changed

3 files changed

+218
-114
lines changed

‎rules/integrations/aws/initial_access_signin_console_login_federated_user.toml‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
[metadata]
2+
creation_date = "2024/08/19"
3+
integration = ["aws"]
4+
maturity = "production"
5+
updated_date = "2025/10/09"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies when a federated user logs into the AWS Management Console. Federated users are typically given temporary
11+
credentials to access AWS services. If a federated user logs into the AWS Management Console without using MFA, it may
12+
indicate a security risk, as MFA adds an additional layer of security to the authentication process. However, CloudTrail
13+
does not record whether a Federated User utilized MFA as part of authentication — that MFA decision often occurs at a
14+
third-party IdP (e.g., Okta, Azure AD, Google). As a result, CloudTrail fields such as MFAUsed / mfaAuthenticated appear
15+
as “No/false” for federated console logins even if IdP MFA was required. This alert should be correlated with IdP
16+
authentication logs to verify whether MFA was enforced for the session. Increase priority if you find a related
17+
"GetSigninToken" event whose source IP / ASN / geo or user-agent differs from the subsequent "ConsoleLogin" (possible
18+
token relay/abuse). Same-IP/UA pairs within a short window are more consistent with expected operator behavior and can
19+
be triaged with lower severity.
20+
"""
21+
from = "now-6m"
22+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
23+
language = "kuery"
24+
license = "Elastic License v2"
25+
name = "AWS Sign-In Console Login with Federated User"
26+
note = """## Triage and analysis
27+
28+
> **Disclaimer**:
29+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
30+
31+
### Investigating AWS Sign-In Console Login with Federated User
32+
33+
Federated users in AWS are granted temporary credentials to access resources, often without the need for a permanent account. This setup is convenient but can be risky if not properly secured with multi-factor authentication (MFA). Adversaries might exploit this by using stolen or misconfigured credentials to gain unauthorized access. CloudTrail alone cannot reliably indicate MFA usage for federated logins. This rule surfaces potentially risky access for analyst review and IdP correlation.
34+
35+
### Possible investigation steps
36+
37+
- **Identify the prinicipal involved**
38+
- `aws.cloudtrail.user_identity.arn` (federated session ARN)
39+
- `aws.cloudtrail.user_identity.session_context.session_issuer.*` (role ARN/name, account) of the identity that created the federated session.
40+
- **Investigate the source context**
41+
- examine `source.ip`, ASN, `geo` fields, and `user_agent.original`
42+
- Compare against normal IP ranges, known user-agents and expected locations for this identity
43+
#### Correlate to raise/lower priority
44+
- **Check IdP MFA:** Find the corresponding IdP login around the same time and verify MFA was required and passed. If IdP shows **no MFA**, raise severity.
45+
- **Federation token pivot:** Look for a nearby `signin.amazonaws.com` `GetSigninToken` API call.
46+
- **More suspicious:** token creation and console login from different public IPs/ASNs/geo fields.
47+
- **Less suspicious:** same IP and expected user agents within ~10–15 minutes (typical operator behavior).
48+
- **Rareness/anomaly signals:** new/rare role or session issuer, rare source IP/ASN/geo, unusual time-of-day, multiple ConsoleLogin events from disparate networks in a short window.
49+
- Review recent activity associated with the federated user to identify any unusual or unauthorized actions that may have occurred following the login event.
50+
- Assess the configuration and policies of the Identity Provider (IdP) used for federated access to ensure MFA is enforced and properly configured for all users.
51+
52+
### Related rules
53+
- AWS Sign-In Token Created - f754e348-f36f-4510-8087-d7f29874cc12
54+
55+
### False positive analysis
56+
- Organizations using SSO for console access will routinely see federated `ConsoleLogin` where CloudTrail shows `MFAUsed: "No"` — this is expected due to IdP-side MFA.
57+
- Internal tools/automation that create federation links (`GetSigninToken`) for operators.
58+
- Maintain allow-lists for corp/VPN CIDRs, approved ASNs, and known automation user-agents.
59+
60+
### Response and remediation
61+
- If IdP confirms MFA and the source context is expected: document and close.
62+
- If IdP shows no MFA or context is suspicious:
63+
- Notify the security team and relevant stakeholders about the potential security breach to ensure coordinated response efforts.
64+
- Disable/lock the IdP account pending review; invalidate IdP sessions if supported.
65+
- Temporarily restrict access (e.g., SCPs, session policies, IP-based conditions).
66+
- Conduct a thorough review of AWS CloudTrail logs to identify any suspicious activities or unauthorized access attempts associated with both the intitiating user and the federated user account.
67+
- Hunt for a preceding `GetSigninToken` from a different IP/ASN/UA (possible token relay).
68+
- Ensure IdP policy enforces MFA for AWS app access; re-verify role trust and least-privilege policies.
69+
- Implement or enforce multi-factor authentication (MFA) for all federated user accounts to enhance security and prevent similar incidents in the future.
70+
- Review and update IAM policies and roles associated with federated users to ensure they follow the principle of least privilege.
71+
"""
72+
references = ["https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/"]
73+
risk_score = 47
74+
rule_id = "1f45720e-5ea8-11ef-90d2-f661ea17fbce"
75+
severity = "medium"
76+
tags = [
77+
"Domain: Cloud",
78+
"Data Source: Amazon Web Services",
79+
"Data Source: AWS",
80+
"Data Source: AWS Sign-In",
81+
"Use Case: Identity and Access Audit",
82+
"Tactic: Initial Access",
83+
"Resources: Investigation Guide",
84+
]
85+
timestamp_override = "event.ingested"
86+
type = "query"
87+
88+
query = '''
89+
event.dataset: "aws.cloudtrail" and
90+
event.provider: "signin.amazonaws.com" and
91+
event.action : "ConsoleLogin" and
92+
aws.cloudtrail.user_identity.type: "FederatedUser" and
93+
event.outcome: "success"
94+
'''
95+
96+
97+
[[rule.threat]]
98+
framework = "MITRE ATT&CK"
99+
[[rule.threat.technique]]
100+
id = "T1078"
101+
name = "Valid Accounts"
102+
reference = "https://attack.mitre.org/techniques/T1078/"
103+
[[rule.threat.technique.subtechnique]]
104+
id = "T1078.004"
105+
name = "Cloud Accounts"
106+
reference = "https://attack.mitre.org/techniques/T1078/004/"
107+
108+
109+
110+
[rule.threat.tactic]
111+
id = "TA0001"
112+
name = "Initial Access"
113+
reference = "https://attack.mitre.org/tactics/TA0001/"
114+
115+
[rule.investigation_fields]
116+
field_names = [
117+
"@timestamp",
118+
"user.name",
119+
"user_agent.original",
120+
"source.ip",
121+
"aws.cloudtrail.user_identity.arn",
122+
"aws.cloudtrail.user_identity.type",
123+
"aws.cloudtrail.user_identity.session_context.session_issuer.arn",
124+
"aws.cloudtrail.user_identity.session_context.session_issuer.type",
125+
"aws.cloudtrail.user_identity.access_key_id",
126+
"event.action",
127+
"event.outcome",
128+
"cloud.account.id",
129+
"cloud.region",
130+
]
131+

‎rules/integrations/aws/initial_access_signin_console_login_no_mfa.toml‎

Lines changed: 0 additions & 114 deletions
This file was deleted.

‎rules_building_block/initial_access_aws_signin_token_created.toml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
[metadata]
2+
bypass_bbr_timing = true
3+
creation_date = "2025/10/09"
4+
integration = ["aws"]
5+
maturity = "production"
6+
updated_date = "2025/10/09"
7+
8+
[rule]
9+
author = ["Elastic"]
10+
building_block_type = "default"
11+
description = """
12+
Captures requests to the AWS federation endpoint (signin.amazonaws.com) for GetSigninToken. This API exchanges existing
13+
temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is
14+
embedded in a one-click URL to the AWS Management Console. It is commonly used by custom federation tools and automation
15+
to pivot from programmatic access to a browser session. This is a building block rule meant to be used for correlation
16+
with other rules to detect suspicious activity.
17+
"""
18+
false_positives = [
19+
"""
20+
Legitimate federation workflows, admin portals, SSO helpers, CI/CD jobs, or internal scripts that create one-click
21+
console links, commonly invoke GetSigninToken and may generate frequent benign events.
22+
""",
23+
]
24+
from = "now-6m"
25+
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
26+
language = "kuery"
27+
license = "Elastic License v2"
28+
name = "AWS Sign-In Token Created"
29+
references = ["https://hackingthe.cloud/aws/post_exploitation/create_a_console_session_from_iam_credentials/"]
30+
risk_score = 21
31+
rule_id = "f754e348-f36f-4510-8087-d7f29874cc12"
32+
severity = "low"
33+
tags = [
34+
"Domain: Cloud",
35+
"Data Source: AWS",
36+
"Data Source: Amazon Web Services",
37+
"Data Source: AWS Sign-In",
38+
"Use Case: Identity and Access Audit",
39+
"Tactic: Initial Access",
40+
"Rule Type: BBR",
41+
]
42+
timestamp_override = "event.ingested"
43+
type = "query"
44+
45+
query = '''
46+
event.dataset: "aws.cloudtrail" and
47+
event.provider: "signin.amazonaws.com" and
48+
event.action : "GetSigninToken" and
49+
event.outcome: "success"
50+
'''
51+
52+
53+
[[rule.threat]]
54+
framework = "MITRE ATT&CK"
55+
[[rule.threat.technique]]
56+
id = "T1078"
57+
name = "Valid Accounts"
58+
reference = "https://attack.mitre.org/techniques/T1078/"
59+
[[rule.threat.technique.subtechnique]]
60+
id = "T1078.004"
61+
name = "Cloud Accounts"
62+
reference = "https://attack.mitre.org/techniques/T1078/004/"
63+
64+
65+
66+
[rule.threat.tactic]
67+
id = "TA0001"
68+
name = "Initial Access"
69+
reference = "https://attack.mitre.org/tactics/TA0001/"
70+
71+
[rule.investigation_fields]
72+
field_names = [
73+
"@timestamp",
74+
"user.name",
75+
"user_agent.original",
76+
"source.ip",
77+
"aws.cloudtrail.user_identity.arn",
78+
"aws.cloudtrail.user_identity.type",
79+
"aws.cloudtrail.user_identity.session_context.session_issuer.arn",
80+
"aws.cloudtrail.user_identity.session_context.session_issuer.type",
81+
"aws.cloudtrail.user_identity.access_key_id",
82+
"event.action",
83+
"event.outcome",
84+
"cloud.account.id",
85+
"cloud.region",
86+
]
87+

0 commit comments

Comments
 (0)