Tag
AWS STS GetCallerIdentity API Called for the First Time
2 rules 2 TTPsAn adversary with access to compromised AWS credentials may attempt to verify their validity and determine the account they are using by calling the STS GetCallerIdentity API, potentially indicating credential compromise and unauthorized discovery activity.
AWS STS AssumeRole with New MFA Device
2 rules 4 TTPsThis rule identifies when a user has assumed a role using a new MFA device in AWS, which can be indicative of persistence and privilege escalation attempts by threat actors.
AWS STS Role Chaining for Privilege Escalation and Persistence
2 rules 3 TTPsAWS STS role chaining, where one assumed role is used to assume another, can lead to privilege escalation or persistence by refreshing session tokens, triggering alerts on the first observed role assumption based on CloudTrail logs.
AWS STS Role Assumption by Service for Privilege Escalation
2 rules 2 TTPsDetection of AWS services assuming roles within AWS Security Token Service (STS) to gain temporary credentials and potentially escalate privileges or move laterally within the AWS environment.
Suspicious AWS STS GetSessionToken Usage
2 rules 2 TTPsThe AWS STS GetSessionToken API is being misused to create temporary tokens for lateral movement and privilege escalation within AWS environments by potentially compromised IAM users.
AWS STS GetFederationToken with AdministratorAccess in Request
2 rules 2 TTPsDetection of AWS STS GetFederationToken calls with AdministratorAccess in the request parameters, indicating potential privilege escalation or dangerous automation via broadly privileged temporary credentials.