Tag
medium
advisory
AWS STS GetCallerIdentity API Called for the First Time
2 rules 2 TTPsAn adversary with access to compromised AWS credentials may attempt to verify their validity and determine the account they are using by calling the STS GetCallerIdentity API, potentially indicating credential compromise and unauthorized discovery activity.
cloud
aws
sts
discovery
2r
2t
medium
advisory
Suspicious AWS STS GetSessionToken Usage
2 rules 2 TTPsThe AWS STS GetSessionToken API is being misused to create temporary tokens for lateral movement and privilege escalation within AWS environments by potentially compromised IAM users.
AWS CloudTrail
aws
cloud
lateral-movement
privilege-escalation
sts
GetSessionToken
2r
2t
high
advisory
AWS STS GetFederationToken with AdministratorAccess in Request
2 rules 2 TTPsDetection of AWS STS GetFederationToken calls with AdministratorAccess in the request parameters, indicating potential privilege escalation or dangerous automation via broadly privileged temporary credentials.
AWS STS
aws
privilege-escalation
lateral-movement
sts
getfederationtoken
2r
2t