AWS GetFederationToken Followed by Console Login via Federation Exchange

Last updated 13 days ago on 2026-08-14

Created 13 days ago on 2026-08-14

About

Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was opened — all from the same source IP within two minutes. This sequence is a high-confidence indicator of credential abuse using stolen IAM access keys.

Tags

Domain: CloudPlatform: AWSData Source: AWSData Source: Amazon Web ServicesData Source: AWS CloudTrailService: AWS STSService: AWS Sign-InRule Type: Event Correlation (EQL)Tactic: Credential AccessLanguage: eql

Severity

high

Risk Score

MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Forge Web Credentials (T1606)(external, opens in a new tab or window)

False Positive Examples

Legacy federation broker applications that call GetFederationToken and immediately redirect users to a console session from the same host may trigger this rule. Validate the source IP against known application server infrastructure and confirm the federation architecture is documented.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗sequence by source.ip with maxspan=2m
  [any where event.provider == "sts.amazonaws.com"
   and event.action == "GetFederationToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "GetSigninToken"
   and event.outcome == "success"]
  [any where event.provider == "signin.amazonaws.com"
   and event.action == "ConsoleLogin"
   and event.outcome == "success"]

Install detection rules in Elastic Security

Detect AWS GetFederationToken Followed by Console Login via Federation Exchange in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).