Skip to content
Threat Feed

Tag

Sts

3 briefs RSS
medium advisory

AWS STS GetCallerIdentity API Called for the First Time

An adversary with access to compromised AWS credentials may attempt to verify their validity and determine the account they are using by calling the STS GetCallerIdentity API, potentially indicating credential compromise and unauthorized discovery activity.

cloud aws sts discovery
2r 2t
medium advisory

Suspicious AWS STS GetSessionToken Usage

The AWS STS GetSessionToken API is being misused to create temporary tokens for lateral movement and privilege escalation within AWS environments by potentially compromised IAM users.

AWS CloudTrail aws cloud lateral-movement privilege-escalation sts GetSessionToken
2r 2t
high advisory

AWS STS GetFederationToken with AdministratorAccess in Request

Detection of AWS STS GetFederationToken calls with AdministratorAccess in the request parameters, indicating potential privilege escalation or dangerous automation via broadly privileged temporary credentials.

AWS STS aws privilege-escalation lateral-movement sts getfederationtoken
2r 2t