Skip to content
Threat Feed
Subscribe

Product

AWS Security Token Service (STS)

2 briefs RSS
high threat

AWS Discovery API Calls from VPN ASN for the First Time by Identity

This threat detection rule identifies initial reconnaissance activities within AWS by flagging an IAM principal's first-time invocation of sensitive discovery APIs, such as GetCallerIdentity, ListUsers, ListBuckets, and DescribeInstances, when the originating IP address is associated with consumer VPNs, high-usage hosting providers, or networks linked to threat groups like TeamPCP, indicating an attacker performing enumeration of cloud resources from a suspicious network origin.

AWS CloudTrail +12 TeamPCP aws-cloudtrail iam discovery cloud identity threat-detection
1r 2t 22i updated
medium advisory

AWS STS Role Assumption by Service for Privilege Escalation

Detection of AWS services assuming roles within AWS Security Token Service (STS) to gain temporary credentials and potentially escalate privileges or move laterally within the AWS environment.

AWS Security Token Service aws sts privilege-escalation lateral-movement
2r 2t