LoFP LoFP / t1021.007

t1021.007

TitleTags
getsignintoken events will occur when using aws sso portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. non-sso configured roles would be abnormal and should be investigated.
legitimate adminstrative usage of this functionality will trigger this detection.