Skip to content

Commit d1ed0aa

Browse files
imays11imays11
committed
toml-lint
1 parent 6c4c2e6 commit d1ed0aa

File tree

2 files changed

+57
-44
lines changed

2 files changed

+57
-44
lines changed

‎rules/integrations/aws/initial_access_signin_console_login_federated_user.toml‎

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,16 @@ updated_date = "2025/10/09"
77
[rule]
88
author = ["Elastic"]
99
description = """
10-
Identifies when a federated user logs into the AWS Management Console. Federated users are typically given temporary credentials to access AWS services. If a federated user logs into the AWS Management Console without using MFA, it may indicate a security risk, as MFA adds an additional layer of security to the authentication process.
11-
12-
However, CloudTrail does not record whether a Federated User utilized MFA as part of authentication — that MFA decision often occurs at a third-party IdP (e.g., Okta, Azure AD, Google). As a result, CloudTrail fields such as MFAUsed / mfaAuthenticated appear as “No/false” for federated console logins even if IdP MFA was required.
13-
14-
This alert should be correlated with IdP authentication logs to verify whether MFA was enforced
15-
for the session. Increase priority if you find a related "GetSigninToken" event whose source IP / ASN / geo
16-
or user-agent differs from the subsequent "ConsoleLogin" (possible token relay/abuse). Same-IP/UA pairs within a short window are more consistent with expected operator behavior and can be triaged with lower severity.
10+
Identifies when a federated user logs into the AWS Management Console. Federated users are typically given temporary
11+
credentials to access AWS services. If a federated user logs into the AWS Management Console without using MFA, it may
12+
indicate a security risk, as MFA adds an additional layer of security to the authentication process. However, CloudTrail
13+
does not record whether a Federated User utilized MFA as part of authentication — that MFA decision often occurs at a
14+
third-party IdP (e.g., Okta, Azure AD, Google). As a result, CloudTrail fields such as MFAUsed / mfaAuthenticated appear
15+
as “No/false” for federated console logins even if IdP MFA was required. This alert should be correlated with IdP
16+
authentication logs to verify whether MFA was enforced for the session. Increase priority if you find a related
17+
"GetSigninToken" event whose source IP / ASN / geo or user-agent differs from the subsequent "ConsoleLogin" (possible
18+
token relay/abuse). Same-IP/UA pairs within a short window are more consistent with expected operator behavior and can
19+
be triaged with lower severity.
1720
"""
1821
from = "now-6m"
1922
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
@@ -83,28 +86,13 @@ timestamp_override = "event.ingested"
8386
type = "query"
8487

8588
query = '''
86-
event.dataset: "aws.cloudtrail" and
89+
event.dataset: "aws.cloudtrail" and
8790
event.provider: "signin.amazonaws.com" and
8891
event.action : "ConsoleLogin" and
8992
aws.cloudtrail.user_identity.type: "FederatedUser" and
9093
event.outcome: "success"
9194
'''
92-
[rule.investigation_fields]
93-
field_names = [
94-
"@timestamp",
95-
"user.name",
96-
"user_agent.original",
97-
"source.ip",
98-
"aws.cloudtrail.user_identity.arn",
99-
"aws.cloudtrail.user_identity.type",
100-
"aws.cloudtrail.user_identity.session_context.session_issuer.arn",
101-
"aws.cloudtrail.user_identity.session_context.session_issuer.type",
102-
"aws.cloudtrail.user_identity.access_key_id",
103-
"event.action",
104-
"event.outcome",
105-
"cloud.account.id",
106-
"cloud.region"
107-
]
95+
10896

10997
[[rule.threat]]
11098
framework = "MITRE ATT&CK"
@@ -124,3 +112,20 @@ id = "TA0001"
124112
name = "Initial Access"
125113
reference = "https://attack.mitre.org/tactics/TA0001/"
126114

115+
[rule.investigation_fields]
116+
field_names = [
117+
"@timestamp",
118+
"user.name",
119+
"user_agent.original",
120+
"source.ip",
121+
"aws.cloudtrail.user_identity.arn",
122+
"aws.cloudtrail.user_identity.type",
123+
"aws.cloudtrail.user_identity.session_context.session_issuer.arn",
124+
"aws.cloudtrail.user_identity.session_context.session_issuer.type",
125+
"aws.cloudtrail.user_identity.access_key_id",
126+
"event.action",
127+
"event.outcome",
128+
"cloud.account.id",
129+
"cloud.region",
130+
]
131+

‎rules_building_block/initial_access_aws_signin_token_created.toml‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,16 @@ updated_date = "2025/10/09"
99
author = ["Elastic"]
1010
building_block_type = "default"
1111
description = """
12-
Captures requests to the AWS federation endpoint (signin.amazonaws.com) for GetSigninToken. This API exchanges existing temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is embedded in a one-click URL to the AWS Management Console. It is commonly used by custom federation tools and automation to pivot from programmatic access to a browser session. This is a building block rule meant to be used for correlation with other rules to detect suspicious activity.
12+
Captures requests to the AWS federation endpoint (signin.amazonaws.com) for GetSigninToken. This API exchanges existing
13+
temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is
14+
embedded in a one-click URL to the AWS Management Console. It is commonly used by custom federation tools and automation
15+
to pivot from programmatic access to a browser session. This is a building block rule meant to be used for correlation
16+
with other rules to detect suspicious activity.
1317
"""
1418
false_positives = [
1519
"""
16-
Legitimate federation workflows, admin portals, SSO helpers, CI/CD jobs, or internal scripts that create one-click console links, commonly invoke GetSigninToken and may generate frequent benign events.
20+
Legitimate federation workflows, admin portals, SSO helpers, CI/CD jobs, or internal scripts that create one-click
21+
console links, commonly invoke GetSigninToken and may generate frequent benign events.
1722
""",
1823
]
1924
from = "now-6m"
@@ -38,28 +43,12 @@ timestamp_override = "event.ingested"
3843
type = "query"
3944

4045
query = '''
41-
event.dataset: "aws.cloudtrail" and
46+
event.dataset: "aws.cloudtrail" and
4247
event.provider: "signin.amazonaws.com" and
4348
event.action : "GetSigninToken" and
44-
event.outcome: "success"
49+
event.outcome: "success"
4550
'''
4651

47-
[rule.investigation_fields]
48-
field_names = [
49-
"@timestamp",
50-
"user.name",
51-
"user_agent.original",
52-
"source.ip",
53-
"aws.cloudtrail.user_identity.arn",
54-
"aws.cloudtrail.user_identity.type",
55-
"aws.cloudtrail.user_identity.session_context.session_issuer.arn",
56-
"aws.cloudtrail.user_identity.session_context.session_issuer.type",
57-
"aws.cloudtrail.user_identity.access_key_id",
58-
"event.action",
59-
"event.outcome",
60-
"cloud.account.id",
61-
"cloud.region"
62-
]
6352

6453
[[rule.threat]]
6554
framework = "MITRE ATT&CK"
@@ -73,7 +62,26 @@ name = "Cloud Accounts"
7362
reference = "https://attack.mitre.org/techniques/T1078/004/"
7463

7564

65+
7666
[rule.threat.tactic]
7767
id = "TA0001"
7868
name = "Initial Access"
7969
reference = "https://attack.mitre.org/tactics/TA0001/"
70+
71+
[rule.investigation_fields]
72+
field_names = [
73+
"@timestamp",
74+
"user.name",
75+
"user_agent.original",
76+
"source.ip",
77+
"aws.cloudtrail.user_identity.arn",
78+
"aws.cloudtrail.user_identity.type",
79+
"aws.cloudtrail.user_identity.session_context.session_issuer.arn",
80+
"aws.cloudtrail.user_identity.session_context.session_issuer.type",
81+
"aws.cloudtrail.user_identity.access_key_id",
82+
"event.action",
83+
"event.outcome",
84+
"cloud.account.id",
85+
"cloud.region",
86+
]
87+

0 commit comments

Comments
 (0)