AWS STS AssumeRole with New MFA Device

Adversaries targeting AWS environments may attempt to register new Multi-Factor Authentication (MFA) devices against compromised IAM identities to secure long-term access. By leveraging the AWS Security Token Service (STS) AssumeRole, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity APIs, an attacker with valid but potentially limited credentials can perform privilege escalation or lateral movement. The registration of a new MFA device serves as a mechanism to bypass or supersede existing authentication requirements, granting the adversary persistent access to the assumed role's permissions. Defenders should monitor CloudTrail for successful role assumptions that reference previously unseen MFA serial numbers, as this pattern often deviates from standard administrative workflows or automated service account behavior.

Attack Chain

1. An attacker gains initial access to a set of AWS IAM credentials (e.g., via hardcoded keys, leaked environment variables, or SSRF).
2. The attacker uses the compromised credentials to query current IAM user permissions and MFA device configurations.
3. The attacker registers a new, attacker-controlled MFA device (e.g., virtual MFA) to the compromised IAM user account via CreateVirtualMFADevice.
4. The attacker associates the new MFA device with the target IAM role or user using EnableMFADevice.
5. The attacker executes AssumeRole or a related STS action, providing the new MFA serial number in the request parameters.
6. AWS validates the new MFA token, and the attacker receives temporary security credentials.
7. The attacker leverages the elevated temporary session credentials to access, exfiltrate, or manipulate AWS resources.

Impact

Successful exploitation allows an adversary to maintain persistent access to an AWS account, escalate privileges beyond the initial scope, and move laterally across different accounts or services. This activity can lead to unauthorized data exfiltration, service disruption, or total account takeover depending on the IAM policies attached to the assumed role.

Recommendation

Prioritize monitoring of AWS CloudTrail logs for unusual AssumeRole events. Establish a baseline for normal MFA registrations and role assumptions to reduce false positives from legitimate administrative tasks.

• Implement alerts for successful AssumeRole events where the request_parameters.serialNumber field is present and indicates a newly registered device.
• Review all MFA device registration events (e.g., CreateVirtualMFADevice) alongside AssumeRole activity to identify unauthorized additions.
• Revoke temporary credentials immediately if a role assumption is linked to an unauthorized MFA device registration.
• Audit IAM policies to ensure that only authorized users have the permission to manage their own MFA devices.