AWS GetFederationToken Followed by Console Login via Federation Exchange

[metadata]
creation_date = "2026/08/14"
integration = ["aws"]
maturity = "production"
updated_date = "2026/08/14"

[rule]
author = ["Elastic"]
description = """
Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated
long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken
obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token
via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was
opened — all from the same source IP within two minutes. This sequence is a high-confidence
indicator of credential abuse using stolen IAM access keys.
"""
false_positives = [
    """
    Legacy federation broker applications that call GetFederationToken and immediately redirect
    users to a console session from the same host may trigger this rule. Validate the source IP
    against known application server infrastructure and confirm the federation architecture is
    documented.
    """,
]
from = "now-6m"
index = ["logs-aws.cloudtrail-*"]
language = "eql"
license = "Elastic License v2"
name = "AWS GetFederationToken Followed by Console Login via Federation Exchange"
note = """## Triage and analysis

### Investigating AWS GetFederationToken Followed by Console Login via Federation Exchange

This rule detects the aws_consoler attack chain: an adversary exfiltrates a long-term IAM access key (AKIA* prefix), runs aws_consoler or equivalent tooling, which calls `GetFederationToken` to obtain temporary credentials and then exchanges them at the AWS federation endpoint (`https://signin.amazonaws.com/federation`) for a signed console URL. Opening that URL triggers a `ConsoleLogin` event from the same source IP, completing the sequence.

The source IP correlation distinguishes this pattern from coincidental federation activity: both the API call and the browser-based console login originate from the same attacker machine in automated tooling scenarios.

### Possible investigation steps

- Identify the IAM user from `aws.cloudtrail.user_identity.arn` in the first event and confirm whether this user and access key are expected to call `GetFederationToken`.
- Review `source.ip` against known infrastructure. A call from an unexpected geography or cloud provider IP range is a strong indicator of exfiltrated key abuse.
- Query CloudTrail for all API calls made during the resulting console session (user identity type `FederatedUser`) in the window following the `ConsoleLogin`.
- Check GitHub, GitLab, CI/CD pipelines, and `.env` files for exposure of the access key.
- Determine whether any sensitive resources were accessed or modified during the console session.

### Response and remediation

- Immediately deactivate the long-term access key used in the `GetFederationToken` call.
- Revoke all active sessions for the IAM user.
- Review all actions taken during the federated console session and assess blast radius.
- Rotate all credentials associated with the IAM user.
- Migrate any legitimate federation use cases to IAM Identity Center or AssumeRoleWithWebIdentity.
"""
references = [
    "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html",
    "https://github.com/NetSPI/aws_consoler",
    "https://www.netspi.com/blog/technical-blog/cloud-pentesting/gaining-aws-console-access-via-api-keys/",
    "https://securitylabs.datadoghq.com/cloud-security-atlas/attacks/accessing-the-aws-console-with-getfederationtoken/"
]
risk_score = 73
rule_id = "065a9a1b-9e48-45a1-8fa5-72373245847c"
setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. STS and sign-in management events are logged by default."
severity = "high"
tags = [
    "Domain: Cloud",
    "Platform: AWS",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Service: AWS STS",
    "Service: AWS Sign-In",
    "Rule Type: Event Correlation (EQL)",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
sequence by source.ip with maxspan=2m
  [any where event.provider == "sts.amazonaws.com"
   and event.action == "GetFederationToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "GetSigninToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "ConsoleLogin"
   and event.outcome == "success"]
'''

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1606"
name = "Forge Web Credentials"
reference = "https://attack.mitre.org/techniques/T1606/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "aws.cloudtrail.user_identity.arn",
    "aws.cloudtrail.user_identity.type",
    "aws.cloudtrail.user_identity.access_key_id",
    "user.name",
    "event.provider",
    "event.action",
    "event.outcome",
    "source.ip",
    "source.as.organization.name",
    "cloud.region",
    "cloud.account.id",
]