Skip to content
Threat Feed
Subscribe

Product

AWS Security Token Service (STS)

3 briefs RSS
low advisory

AWS STS AssumeRole with New MFA Device

Adversaries may register new MFA devices for compromised AWS IAM roles to maintain persistence, escalate privileges, or facilitate lateral movement by assuming roles via the AWS Security Token Service (STS).

AWS Security Token Service +1 cloud aws persistence identity-audit
3t
high threat

AWS Discovery API Calls from VPN ASN for the First Time by Identity

This threat detection rule identifies initial reconnaissance activities within AWS by flagging an IAM principal's first-time invocation of sensitive discovery APIs, such as GetCallerIdentity, ListUsers, ListBuckets, and DescribeInstances, when the originating IP address is associated with consumer VPNs, high-usage hosting providers, or networks linked to threat groups like TeamPCP, indicating an attacker performing enumeration of cloud resources from a suspicious network origin.

AWS CloudTrail +12 TeamPCP aws-cloudtrail iam discovery cloud identity threat-detection
1r 2t 22i updated
medium advisory

AWS STS Role Assumption by Service for Privilege Escalation

Detection of AWS services assuming roles within AWS Security Token Service (STS) to gain temporary credentials and potentially escalate privileges or move laterally within the AWS environment.

AWS Security Token Service aws sts privilege-escalation lateral-movement
2r 2t