Product
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN
2 rules 1 TTPDetects successful AWS AssumeRoleWithWebIdentity where the caller identity is a Kubernetes service account and the source autonomous system organization is not Amazon.com, Inc., potentially indicating a stolen or misused service-account token being used off-cluster.
AWS EC2 Role GetCallerIdentity from New Source AS Organization
2 rules 1 TTPThe rule detects when an EC2 instance role session calls AWS STS GetCallerIdentity from a new source autonomous system (AS) organization name, indicating potential credential theft and verification from outside expected egress paths.
AWS Discovery API Calls from VPN ASN by New Identity
2 rules 1 TTPThis rule detects the initial use of AWS discovery APIs from VPN-associated ASNs by a previously unseen identity, indicating potential reconnaissance activity.
AWS IAM Customer Managed Policy Version Manipulation for Privilege Escalation
2 rules 2 TTPsSuccessful creation of new or setting default versions of customer-managed IAM policies can indicate privilege escalation attempts by attackers modifying policy permissions.
AWS Network Access Control List Deletion Detected
2 rules 1 TTPDetection of AWS Network Access Control List (ACL) deletion using AWS CloudTrail logs, which can remove critical access restrictions, potentially allowing unauthorized access to cloud instances and leading to data exfiltration or further compromise.