detection.wiki

AWS Security Token Service

eventNameDescriptionSampleRule
anyCatch-all entry for AWS Security Token Service rules that match the service but not a specific eventName.NN
AssumeRoleReturns temporary security credentials for an IAM role that the caller is authorized to assume.YY
AssumeRoleWithSAMLReturns temporary security credentials for users authenticated via a SAML 2.0 assertion.YY
AssumeRoleWithWebIdentityReturns temporary security credentials for users authenticated via a web identity token, such as an OIDC provider.NY
AssumeRootReturns temporary credentials to perform privileged actions on a member account in an AWS organization using the root user context.NY
GetCallerIdentityReturns details about the IAM user or role whose credentials are used to call the operation.YY
GetFederationTokenReturns temporary credentials for a federated user, scoped by the caller-supplied policy.YY
GetSessionTokenReturns temporary credentials for an IAM user, optionally requiring MFA authentication.YY
DecodeAuthorizationMessageDecodes additional information about the authorization status of a request from an encoded message returned in response to an Amazon Web Services request.YN
GetAccessKeyInfoReturns the account identifier for the specified access key ID.YN
GetDelegatedAccessTokenExchanges a trade-in token for temporary Amazon Web Services credentials with the permissions associated with the assumed principal.NN
GetWebIdentityTokenReturns a signed JSON Web Token (JWT) that represents the calling Amazon Web Services identity.YN

any: AWS Security Token Service (catch-all)

#
Service
sts

Description

Catch-all entry for AWS Security Token Service rules that match the service but not a specific eventName.

AssumeRole

#
Service
sts

Description

Returns temporary security credentials for an IAM role that the caller is authorized to assume.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "fc7df72b-2505-4ed9-9f06-384b94f6e7a2",
  "eventName": "AssumeRole",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2023-07-10T12:15:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "c5dc783a-c8b9-47f4-8d0f-fff71f5b8866",
  "requestParameters": {
    "durationSeconds": 900,
    "policy": {
      "Version": "2008-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "ec2:AllocateAddress",
            "ec2:AssignPrivateIpAddresses",
            "ec2:AssociateAddress",
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:CreateNetworkInterface",
            "ec2:CreateSecurityGroup",
            "ec2:DeleteNetworkInterface",
            "ec2:DeleteSecurityGroup",
            "ec2:DescribeAddresses",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeCoipPools",
            "ec2:DescribeInternetGateways",
            "ec2:DescribeLocalGatewayRouteTables",
            "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
            "ec2:DescribeLocalGateways",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeSubnets",
            "ec2:DescribeVpcAttribute",
            "ec2:DescribeVpcs",
            "ec2:DisassociateAddress",
            "ec2:ModifyNetworkInterfaceAttribute",
            "ec2:ReleaseAddress",
            "ec2:RevokeSecurityGroupIngress",
            "ec2:UnassignPrivateIpAddresses",
            "sns:Publish",
            "sns:ListTopic"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "secretsmanager:GetSecretValue",
            "secretsmanager:DescribeSecret",
            "secretsmanager:RestoreSecret",
            "secretsmanager:CreateSecret",
            "secretsmanager:DeleteSecret",
            "secretsmanager:UpdateSecret"
          ],
          "Resource": "arn:aws:secretsmanager:*:*:secret:rds-sqlserver-ssrs!*"
        }
      ]
    },
    "roleArn": "arn:aws:iam::123837392027:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
    "roleSessionName": "SLRManagement"
  },
  "resources": [
    {
      "ARN": "arn:aws:iam::123837392027:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
      "accountId": "123837392027",
      "type": "AWS::IAM::Role"
    }
  ],
  "responseElements": {
    "assumedRoleUser": {
      "arn": "arn:aws:sts::123837392027:assumed-role/AWSServiceRoleForRDS/SLRManagement",
      "assumedRoleId": "AROATFQR7NSCRR66DMFTC:SLRManagement"
    },
    "credentials": {
      "accessKeyId": "ASIATFQR7NSC7WDHC2D5",
      "expiration": "Jul 10, 2023, 12:30:04 PM",
      "sessionToken": "IQoJb3JpZ2luX2VjEC0aCXVzLWVhc3QtMSJGMEQCIDZT6g+3wEby/xinGndB88XkPNvaVSQvLI66n97s3NdDAiAoogBphPZMl+qRu+2ekeqYjg8enntddh2WdVUZ8p3j8ir8BQil//////////8BEAEaDDIxODAwNzMwMTI1MyIMn46a4iadKGBP87mLKtAF4J4WMscf1CT5iHaDf1LPKY9lJezy2VbsWD4CrBOXjjNKMBzDopYI6gk/Xfq1Qx3usGNyw2PtkWRPKw0rKo7leRFd3791KKsPdnpKQ27Ce9Qo/Abo6eg/oWNihHFZfckT52onboy7+MCot6LyoIcOs7A5JrMFvuUJs0TLF+Fw1iuK/6fbN8GG0Ir6+BJo+X3cCqAigBNImrobNKBJa9c3UfN3+IJLVZ2u7eNlhGdYcsx6tehg4OgDi7J6Hw6C7xWrAnTvQhi279cx+tWYQt73B9SNBHs/Xcqrn18iepXo6URv3yzZdQ+2Pu3nb1LFCPHwGBeAv9uYsUMsusXxisr85ee3gnaQNwGrUkigc2zOKzVywASSc1sSGcVxcpBLDsZvxXaNcbMonr99VnhMrBpKOWdPkXgFcE9OABSXmI6FXccSfDu7nwilu8yxozlRTi3fGebYS/uE6fLrrvFXhjtwsXqXTN8yJQhGHu6cE7B+iSJr6HH7cP7CgG5bpyqWVIF9pkKofdLJj3w3Kd7jQXcmBepn6tY9j7xswZLnaMOiPsOBRX34UAheRiREcKxRA8keI3hLBDtDBosESYng86kHftz94F4krzNvBlB67SyOFUK+/p4aTsQ8ejLTVgp/0s1YC3Fq2+ulb8hhbNmWlJvanLBFFo+rBorXjX/E++IrR552V3pwvVtO5xdVUBOX6NDSvHspKRP6zLd8jZSQEZuWIlQ+dJT5D8AeMIM8KAm3bmHdZJboz3Z0j8szCI5/nl9P3QfmrFm2NY+oEgH7yv7bQEcCYPIjQQI9DQb5qKb2LqzC8I6fHa72iPdV1GFS+8s50jI0ZpO51SG6+vlQqkNnlNx1ImHNqRKYMusdEuNCF5Zo8DaNoK5LMrr3wCblLLyyHbeCL2Q6+8m+cps5ayESwSugJozF7xYqK/7BBfDjI/wnEbr3+W+qKbtu9zWu6ZJtMMjsr6UGOsABa6GKC/Ife9UkOgS/HuwZO1L0wjJSQ2coiLx+OgN/ER+ihM+HriZZQFSvEa4T/oyJAPbx9nn0ur5jyg5kAQe9dIAthduYyuxjKwz00mYoldy5xgsHmHo9ihmj56pAuQorYEnARyPE1C4s/BeEHtIt35oVGyYS3Wnpp7Wz7837WpDYpm0B3mM//f54nGuUVtufdaKAOPG0WH3QixoE4CF1CprKnQWwj0o6mPYX1aFHty70L7B4loay8pctR6PVFb/w"
    },
    "packedPolicySize": 91
  },
  "sharedEventID": "054606c2-fa82-4c13-97fd-edc63f264058",
  "sourceIPAddress": "rds.amazonaws.com",
  "userAgent": "rds.amazonaws.com",
  "userIdentity": {
    "invokedBy": "rds.amazonaws.com",
    "type": "AWSService"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
requestParameters.roleArn (panther rule field)is_not_null2 rulespanther
api.response.error (splunk rule field)eqaccessdenied1 rulesplunk
aws::userIdentity.type (elastic rule field)eqiamuser1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS STS AssumeRole with New MFA Device source low: Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS). While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.T1078, T1078.004, T1548, T1550, T1550.001, T1556↳ also matches AssumeRoleWithSAML, AssumeRoleWithWebIdentity
  • AWS STS Role Assumption by Service source low: Identifies when a service has assumed a role in AWS Security Token Service (STS). Services can assume a role to obtain temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege escalation. This is a New Terms rule that identifies when a service assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS resources. While often legitimate, adversaries may use this technique for unauthorized access, privilege escalation, or lateral movement within an AWS environment.T1548, T1548.005, T1550, T1550.001
  • AWS STS Role Assumption by User source low: Identifies when a user or role has assumed a role in AWS Security Token Service (STS). Users can assume a role to obtain temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege escalation. This is a New Terms rule that identifies when a user assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS resources. While often legitimate, adversaries may use this technique for unauthorized access, privilege escalation, or lateral movement within an AWS environment.T1078, T1078.004, T1548, T1550, T1550.001

Show 1 more (4 total) on the rules page

Splunk #

  • ASL AWS IAM Assume Role Policy Brute Force source: The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. It leverages AWS CloudTrail logs to identify MalformedPolicyDocumentException errors with a status of failure…T1110, T1580

Panther #

References #

AssumeRoleWithSAML

#
Service
sts

Description

Returns temporary security credentials for users authenticated via a SAML 2.0 assertion.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "b25b825d-9c9b-49d3-9ecd-290dbe8f2c29",
  "eventName": "AssumeRoleWithSAML",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2021-01-22T03:44:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "111111111111",
  "requestID": "e19c7a7f-cd96-4642-9ee6-2360a7b01b12",
  "requestParameters": {
    "durationSeconds": 3600,
    "principalArn": "arn:aws:iam::111111111111:saml-provider/rodsotoonmicrosoft",
    "roleArn": "arn:aws:iam::111111111111:role/rodonmicrotestrole",
    "roleSessionName": "rodsoto@rodsoto.onmicrosoft.com",
    "sAMLAssertionID": "_d33ba0ad-0c88-4b83-80a6-27c08027d000"
  },
  "resources": [
    {
      "ARN": "arn:aws:iam::111111111111:role/rodonmicrotestrole",
      "accountId": "111111111111",
      "type": "AWS::IAM::Role"
    },
    {
      "ARN": "arn:aws:iam::111111111111:saml-provider/rodsotoonmicrosoft",
      "accountId": "111111111111",
      "type": "AWS::IAM::SAMLProvider"
    }
  ],
  "responseElements": {
    "assumedRoleUser": {
      "arn": "arn:aws:sts::111111111111:assumed-role/rodonmicrotestrole/rodsoto@rodsoto.onmicrosoft.com",
      "assumedRoleId": "AROAYTOGP2RLKFUVAQAIJ:rodsoto@rodsoto.onmicrosoft.com"
    },
    "audience": "https://signin.aws.amazon.com/saml",
    "credentials": {
      "accessKeyId": "ASIAYTOGP2RLKJXOV7VR",
      "expiration": "Jan 22, 2021 3:59:16 AM",
      "sessionToken": "IQoJb3JpZ2luX2VjENz//////////wEaCXVzLWVhc3QtMSJGMEQCIHl/WQdLq53ULYl10fPtpeV3H7da9mOXGuIStvhdDA6kAiAdO/7rocOXAtyDV+0MJhSj/piqlqEI/BcAKm8zqBhOgiqgAwi1//////////8BEAIaDDU5MTUxMTE0NzYwNiIMAFP8GfyI/x1fKCHYKvQCznxxgKnEdcuvrr/fBLmHxEDjQ9vQxjasA8gZF8GawZ5SFH9ViKqoZh93bYkOwKqZD8cdqJIo9SYL17RGhVqxzvsjU4+QsRXTN5eGgh+LyF9EZqeCl6oCkaTJqNrXHuenzTi0yiL510LKsSckrAm8+SuwI/jQu3oE1BEcJQieAc4RjYx3II+1cUvyfRlFvR2NDfZhdWcQvAivV06KJg9c2zfCF0Agzn/YZSNvsRL5UhnKhJ2wktSvT8lR0mS3n9xR1j3iYNxVDHab180cnfkP3G6tAmxj5U29diNQrusJxKWWhr/Q9wHRdDj5dO2QUZzSymKKU/UiRJ8nyYPINaJ8XWVAPiT4QgzpMxotkvSkDLEG/brB9yEr2p7W8Y3xMGZ37qSGkuU4z9x40RU9G1XPhv27NO9aaGs/VXYTMCzWRNxnsLfNkk/DihrcaR0SclRcvs+zmfe1ZUoGnfjNYm+AIyJi4D7OrXF5/Mt46Z2y76DnULlAMJCUqYAGOpsBw4fyafV8OizX7Lebh2JRXFZsWBY1GTpyGvO5otrw++4axud44vYVi5iU5rbJxtTBm4vtJartxgXoPJFnQuat9gLrIlXhjmg+m50a5xs1Ut2UWEsWY2Duu4jA9ap7P7dYv9kIK9P2uyhsjKQhCjTpfe4I/llcupbDotYBJuvlB5n85a5kgiSriFk5zetoXQIweuYEWQZsD/AN+LE="
    },
    "issuer": "https://sts.windows.net/0e8108b1-18e9-41a4-961b-dfcddf92ef08/",
    "nameQualifier": "ZRu9MRAjiG9tvi1QBNfdI664G5A=",
    "subject": "rodsoto@rodsoto.onmicrosoft.com",
    "subjectType": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
  },
  "sourceIPAddress": "72.21.217.152",
  "userAgent": "AWS Signin, aws-internal/3 aws-sdk-java/1.11.898 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01 java/1.8.0_275 kotlin/1.3.72 vendor/Oracle_Corporation",
  "userIdentity": {
    "identityProvider": "ZRu9MRAjiG9tvi1QBNfdI664G5A=",
    "principalId": "ZRu9MRAjiG9tvi1QBNfdI664G5A=:rodsoto@rodsoto.onmicrosoft.com",
    "type": "SAMLUser",
    "userName": "rodsoto@rodsoto.onmicrosoft.com"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

References #

AssumeRoleWithWebIdentity

#
Service
sts

Description

Returns temporary security credentials for users authenticated via a web identity token, such as an OIDC provider.

CloudTrail management event, logged by default.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "44ac376d-f693-4f55-a4f5-e07f148d23e7",
  "eventSource": "sts.amazonaws.com",
  "eventName": "AssumeRoleWithWebIdentity",
  "awsRegion": "us-east-2",
  "eventType": "AwsApiCall",
  "readOnly": true,
  "managementEvent": true,
  "requestID": "f0c577c5-1f85-4212-a913-94f67bb8b283",
  "userAgent": "aws-sdk-go-v2/1.41.11 ua/2.1 os/linux lang/go#1.26.4 md/GOOS#linux md/GOARCH#amd64 api/sts#1.42.3",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sts.us-east-2.amazonaws.com",
    "keyExchange": "X25519MLKEM768"
  },
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::IAM::Role",
      "ARN": "arn:aws:iam::123456789012:role/EXAMPLE"
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
source.as.organization.name (elastic rule field)is_not_null1 ruleelastic
user (elastic rule field)starts_withsystem:serviceaccount:1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN source high: Detects successful AssumeRoleWithWebIdentity where the caller identity is a Kubernetes service account and the source autonomous system organization is present but not Amazon.com, Inc. EKS workloads that obtain IAM credentials via IAM Roles for Service Accounts (IRSA) normally reach STS from AWS-managed or AWS-associated networks; the same identity from a clearly external ASN can indicate a stolen or misused projected service-account token being exchanged for IAM credentials off-cluster.T1078, T1078.004
  • AWS STS AssumeRole with New MFA Device source low: Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS). While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.T1078, T1078.004, T1548, T1550, T1550.001, T1556↳ also matches AssumeRole, AssumeRoleWithSAML

AssumeRoot

#
Service
sts

Description

Returns temporary credentials to perform privileged actions on a member account in an AWS organization using the root user context.

CloudTrail management event, logged by default.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS STS AssumeRoot by Rare User and Member Account source high: Identifies when the STS AssumeRoot action is performed by a rare user in AWS. The AssumeRoot action allows users to assume the root member account role, granting elevated but specific permissions based on the task policy specified. Adversaries who have compromised user credentials can use this technique to escalate privileges and gain unauthorized access to AWS resources. This is a New Terms rule that identifies when the STS AssumeRoot action is performed by a user that rarely assumes this role against a specific member account.T1078, T1078.004, T1098, T1098.003, T1548, T1548.005

GetCallerIdentity

#
Service
sts

Description

Returns details about the IAM user or role whose credentials are used to call the operation.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "c51ec284-c59d-4e86-8dc2-a81867b807be",
  "eventName": "GetCallerIdentity",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2023-07-10T11:54:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "32171ab8-c4ab-42e0-af37-4536b0bed016",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "sts.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.1.2 (+https://www.terraform.io) terraform-provider-aws/3.76.1 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.157 (go1.19.3; linux; amd64) stratus-red-team_39f95f43-cd2f-4beb-b69e-be60b6fe1f57 HashiCorp-terraform-exec/0.17.3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
aws::userIdentity.typeeqassumedrole2 ruleselastic, kusto
userAgentcontainstrufflehog2 rulespanther, sigma
source.as.organization.name (elastic rule field)is_not_null1 ruleelastic
user.id (elastic rule field)contains:i-1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

  • AWS STS GetCallerIdentity Enumeration Via TruffleHog source medium: Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.T1087, T1087.004
  • Get Caller Identity source low: The "whoami" for AWS. Attackers will often use this to determine the identity of the current user or role. This is a common first step in AWS reconnaissance. After stealing long-term or short-term access keys, attackers often run aws sts get-caller-identity to determine the identity of the compromised user or role. Any IAM user or role can call this API, and it is often used in scripts to verify the identity of the caller.

Elastic #

  • AWS STS GetCallerIdentity API Called for the First Time source medium: An adversary with access to a set of compromised credentials may attempt to verify that the credentials are valid and determine what account they are using. This rule looks for the first time an identity has called the STS GetCallerIdentity API, which may be an indicator of compromised credentials. A legitimate user would not need to perform this operation as they should know the account they are using.T1033, T1087, T1087.004
  • AWS EC2 Role GetCallerIdentity from New Source AS Organization source medium: Identifies the first time an EC2 instance role session calls AWS STS GetCallerIdentity from a given source autonomous system (AS) organization name within the lookback window. Adversaries who steal instance role credentials often verify them with GetCallerIdentity from infrastructure outside your normal egress paths. Baseline learning on the pairing of identity and source network reduces noise from stable NAT or AWS-classified egress compared to alerting on every call from a non-Amazon ASN.T1087, T1087.004
  • AWS Discovery API Calls from VPN ASN for the First Time by Identity source high: Flags the first time a given IAM principal invokes a narrow set of high-signal discovery APIs (credential check, account and IAM enumeration, bucket and compute inventory, logging introspection) from a source IP whose autonomous system number (ASN) matches a curated set commonly associated with consumer VPN brands, VPN-heavy hosting, and provider networks referenced in public reporting on TeamPCP activity (for example 31173 Services AB AS39351 and Oy Crea Nova Hosting Solution Ltd). Broad List*/Describe* patterns are intentionally omitted to reduce noise. Hosting ASNs are heavily dual-use; validate source.as.number in your data and extend event.action only when your baseline allows it.T1526, T1580

Kusto #

Panther #

  • AWS STS GetCallerIdentity via TruffleHog source medium: Detects AWS STS GetCallerIdentity calls made by TruffleHog, a credential scanning tool. Threat actors use TruffleHog to validate whether leaked or stolen AWS access keys are still active. A GetCallerIdentity call with a TruffleHog user agent indicates that credentials from this account have been discovered externally and are being tested for validity.T1087.004

References #

GetFederationToken

#
Service
sts

Description

Returns temporary credentials for a federated user, scoped by the caller-supplied policy.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:GetFederationToken on resource: arn:aws:sts::811596193553:federated-user/asd",
  "eventID": "ef612b32-db2e-4f43-9a52-1e9f5d75781b",
  "eventName": "GetFederationToken",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2017-03-09T19:40:14Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "375cd94b-0500-11e7-9e20-45e19ea8e4f5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "191.253.250.239",
  "userAgent": "aws-cli/1.11.44 Python/2.7.10 Darwin/16.4.0 botocore/1.5.7",
  "userIdentity": {
    "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • AWS First Occurrence of STS GetFederationToken Request by User source high: Identifies the first occurrence of an AWS Security Token Service (STS) GetFederationToken request made by a user. The GetFederationToken API call allows users to request temporary security credentials to access AWS resources. The maximum expiration period for these tokens is 36 hours and they can be used to create a console signin token even for identities that don't already have one. Adversaries may use this API to obtain temporary credentials for persistence and to bypass IAM API call limitations by gaining console access.T1098, T1098.001, T1550, T1550.001
  • AWS STS GetFederationToken with AdministratorAccess in Request source high: Identifies successful calls to AWS STS GetFederationToken where request parameters reference AdministratorAccess. This API returns temporary security credentials for a federated user with permissions bounded by the calling IAM user and any inline session policy passed in the request. Supplying or referencing the AWS managed AdministratorAccess policy (or an equivalent string in the policy payload) can grant broadly privileged temporary credentials and may indicate privilege abuse or dangerous automation.T1548, T1548.005, T1550, T1550.001

References #

GetSessionToken

#
Service
sts

Description

Returns temporary credentials for an IAM user, optionally requiring MFA authentication.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "711c18c0-adf4-4daf-af2b-7a78610a63ec",
  "eventName": "GetSessionToken",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2017-02-18T19:20:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "5a24199-f60f-11e6-b57a-d02dbf114668",
  "requestParameters": {
    "durationSeconds": 43200
  },
  "responseElements": {
    "credentials": {
      "accessKeyId": "ASIAHXIBGDNPN5DJNB2Q",
      "expiration": "Feb 19, 2017 7:20:48 AM",
      "sessionToken": "FQoDYXdzEGQaDDy9D1uP5XqfvNL0sCKZAf8g5Z1rq6q79XWq+LWwBEQIbSPqa9nDIOnNNM8GwVLdepWzeJuh7mm1sHPheBcq+DX2nYsyvTg3Cs49TOFGx/7Lp7KOjiCNXIaTzoRW52fs1tuuUrQtMbELVD2DESJa55cXtDHSWGYosfmodV1aVEbG+TuCi5zBGJ7cOPKFOul6JEi/Nq4IURRt6MmbLV0oBwcjO05uYkNiUiiQvaLFBQ=="
    }
  },
  "sourceIPAddress": "255.253.125.115",
  "userAgent": "signin.amazonaws.com",
  "userIdentity": {
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:root",
    "invokedBy": "signin.amazonaws.com",
    "principalId": "811596193553",
    "type": "Root"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
aws::userIdentity.type (panther rule field)eqIAMUser1 rulepanther
aws::userIdentity.type (sigma rule field)eqiamuser1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • AWS STS GetSessionToken Usage source low: Identifies the use of GetSessionToken API calls by IAM users or Root Account. While this is a common and legitimate operation used to obtain temporary credentials, it also provides adversaries with a method to generate short-lived tokens for stealthy activity. Attackers who compromise IAM user access keys may call GetSessionToken to create temporary credentials, which they can then use to move laterally, escalate privileges, or persist after key rotation. This rule is intended as a BBR to establish patterns of typical STS usage and support correlation with higher-fidelity detections.T1078, T1078.004, T1548, T1550, T1550.001

YARA-L #

Panther #

Show 1 more (4 total) on the rules page

References #

DecodeAuthorizationMessage

#
Service
sts

Description

Decodes additional information about the authorization status of a request from an encoded message returned in response to an Amazon Web Services request.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:DecodeAuthorizationMessage",
  "eventID": "60fc7ac6-1441-43d8-a0cf-f54369a89faa",
  "eventName": "DecodeAuthorizationMessage",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2018-03-17T00:13:11Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "fa9cfec4-2977-11e8-8591-a36f5be4e06f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "7.8.252.64",
  "userAgent": "aws-cli/1.11.112 Python/2.7.10 Darwin/16.7.0 botocore/1.5.75",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

GetAccessKeyInfo

#
Service
sts

Description

Returns the account identifier for the specified access key ID.

CloudTrail management event, logged by default.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:GetAccessKeyInfo",
  "eventID": "49187-4bda-4c38-893c-d9c8589a92d3",
  "eventName": "GetAccessKeyInfo",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2019-09-23T20:59:35Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "0cae9bcd-de45-11e9-b971-777f98ad9c1e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "91.159.9.108",
  "userAgent": "aws-cli/1.16.234 Python/2.7.15 Darwin/18.7.0 botocore/1.12.231",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

GetDelegatedAccessToken

#
Service
sts

Description

Exchanges a trade-in token for temporary Amazon Web Services credentials with the permissions associated with the assumed principal.

GetWebIdentityToken

#
Service
sts

Description

Returns a signed JSON Web Token (JWT) that represents the calling Amazon Web Services identity.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Requested SigningAlgorithm is not supported. See the GetWebIdentityToken documentation for supported algorithms",
  "eventCategory": "Management",
  "eventID": "38598db7-3a12-4aa1-9374-b43df58342a3",
  "eventName": "GetWebIdentityToken",
  "eventSource": "sts.amazonaws.com",
  "eventTime": "2026-06-29T18:46:14Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ceb6cd82-0b60-4e5a-85cb-e85954c1aea7",
  "requestParameters": {
    "audience": [
      "ddddd"
    ],
    "signingAlgorithm": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "sts.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}