AWS Console GetSigninToken Potential Abuse

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•100

Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.