Detection rules › By event

AWS-sts

Event	Rules
AssumeRole	8
AssumeRoleWithSAML	2
AssumeRoleWithWebIdentity	2
AssumeRoot	1
GetCallerIdentity	7
GetFederationToken	2
GetSessionToken	7

AssumeRole

8 detection rules reference this event. View event page.

Elastic (4)

AWS STS AssumeRole with New MFA Device severity low T1078, T1078.004, T1548, T1550, T1550.001, T1556
AWS STS Role Assumption by Service severity low T1548, T1548.005, T1550, T1550.001
AWS STS Role Assumption by User severity low T1078, T1078.004, T1548, T1550, T1550.001
AWS STS Role Chaining severity medium T1078, T1078.004, T1548, T1550, T1550.001

Splunk (1)

ASL AWS IAM Assume Role Policy Brute Force severity medium T1110, T1580

Panther (3)

RoleAssumes by Multiple Useragents
SIGNAL - Role Assumed by AWS Service severity informational
SIGNAL - Role Assumed by User severity informational

AssumeRoleWithSAML

2 detection rules reference this event. View event page.

Sigma (1)

AWS Suspicious SAML Activity severity medium T1078, T1548, T1550, T1550.001

Elastic (1)

AWS STS AssumeRole with New MFA Device severity low T1078, T1078.004, T1548, T1550, T1550.001, T1556

AssumeRoleWithWebIdentity

2 detection rules reference this event. View event page.

Elastic (2)

AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN severity high T1078, T1078.004
AWS STS AssumeRole with New MFA Device severity low T1078, T1078.004, T1548, T1550, T1550.001, T1556

AssumeRoot

1 detection rules reference this event. View event page.

Elastic (1)

AWS STS AssumeRoot by Rare User and Member Account severity high T1078, T1078.004, T1098, T1098.003, T1548, T1548.005

GetCallerIdentity

7 detection rules reference this event. View event page.

Sigma (2)

AWS STS GetCallerIdentity Enumeration Via TruffleHog severity medium T1087, T1087.004
Get Caller Identity severity low

Elastic (3)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580
AWS EC2 Role GetCallerIdentity from New Source AS Organization severity medium T1087, T1087.004
AWS STS GetCallerIdentity API Called for the First Time severity medium T1033, T1087, T1087.004

Kusto (1)

AWSCloudTrail - Monitor AWS Credential abuse or hijacking severity low T1580

Panther (1)

AWS STS GetCallerIdentity via TruffleHog severity medium T1087.004

GetFederationToken

2 detection rules reference this event. View event page.

Elastic (2)

AWS First Occurrence of STS GetFederationToken Request by User severity high T1098, T1098.001, T1550, T1550.001
AWS STS GetFederationToken with AdministratorAccess in Request severity high T1548, T1548.005, T1550, T1550.001

GetSessionToken

7 detection rules reference this event. View event page.

Sigma (1)

AWS STS GetSessionToken Misuse severity low T1548, T1550, T1550.001

Elastic (1)

AWS STS GetSessionToken Usage severity low building block T1078, T1078.004, T1548, T1550, T1550.001

YARA-L (1)

AWS Lateral Movement Using IAM Session Token severity low T1550

AWS-sts

AssumeRole

Elastic (4)

Splunk (1)

Panther (3)

AssumeRoleWithSAML

Sigma (1)

Elastic (1)

AssumeRoleWithWebIdentity

Elastic (2)

AssumeRoot

Elastic (1)

GetCallerIdentity

Sigma (2)

Elastic (3)

Kusto (1)

Panther (1)

GetFederationToken

Elastic (2)

GetSessionToken

Sigma (1)

Elastic (1)

YARA-L (1)

Panther (4)