This rule detects the three-event chain used by tools like aws_consoler to convert exfiltrated long-term IAM access keys into a temporary federated session and a subsequent AWS Console login. It looks for a sequence, within a 2-minute window, of: (1) a successful GetFederationToken call to sts.amazonaws.com, obtaining temporary credentials; (2) a successful GetSigninToken call to signin.amazonaws.com, exchanging credentials for a federation sign-in token; and (3) a successful ConsoleLogin call to signin.amazonaws.com, indicating a browser-based AWS Console session opened from the same source IP. The detection relies on AWS CloudTrail management events and correlates the source IP across all three events, flagging potential credential abuse from stolen keys. The rule maps to MITRE ATT&CK T1606 (Forge Web Credentials) under TA0006 (Credential Access).