LoFP / legacy federation broker applications that call getfederationtoken and immediately redirect users to a console session from the same host may trigger this rule. validate the source ip against known application server infrastructure and confirm the federation architecture is documented.

Techniques

• T1606

Sample rules

AWS GetFederationToken Followed by Console Login via Federation Exchange

• source: elastic
• technicques:
  • T1606

Description

Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was opened — all from the same source IP within two minutes. This sequence is a high-confidence indicator of credential abuse using stolen IAM access keys.

Detection logic

sequence by source.ip with maxspan=2m
  [any where event.provider == "sts.amazonaws.com"
   and event.action == "GetFederationToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "GetSigninToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "ConsoleLogin"
   and event.outcome == "success"]