AWS STS GetCallerIdentity Enumeration Via TruffleHog

Status: experimental
Severity: medium
Log source: product aws, service cloudtrail
Author: Adan Alvarez @adanalvarez
Source: github.com/SigmaHQ/sigma

Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.

Known false positives

Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1087.004` Account Discovery: Cloud Account

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `GetCallerIdentity`: Returns details about the IAM user or role whose credentials are used to call the operation.

Rules detecting the same action

These rules filter on the same operation.

AWS Discovery API Calls from VPN ASN for the First Time by Identity (Elastic)
AWS EC2 Role GetCallerIdentity from New Source AS Organization (Elastic)
AWS STS GetCallerIdentity API Called for the First Time (Elastic)
AWS STS GetCallerIdentity via TruffleHog (Panther)

Rule body

title: AWS STS GetCallerIdentity Enumeration Via TruffleHog
id: 9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d
status: experimental
description: |
    Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog.
    Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys.
    Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
references:
    - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
    - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
    - https://github.com/trufflesecurity/trufflehog
author: Adan Alvarez @adanalvarez
date: 2025-10-12
tags:
    - attack.discovery
    - attack.t1087.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'sts.amazonaws.com'
        eventName: 'GetCallerIdentity'
        userAgent|contains: 'TruffleHog'
    condition: selection
falsepositives:
    - Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'GetCallerIdentity'
    userAgent|contains: 'TruffleHog'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`GetCallerIdentity`	`field:"aws::eventName" kind:eq value:"GetCallerIdentity"`
`eventSource`	eq	`sts.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"sts.amazonaws.com"`
`userAgent`	match	`TruffleHog`	`field:"userAgent" kind:match value:"TruffleHog"`