AWS STS GetSessionToken Misuse

Status: test
Severity: low
Log source: product aws, service cloudtrail
Author: Austin Songer @austinsonger
Source: github.com/SigmaHQ/sigma

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Known false positives

GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1548` Abuse Elevation Control Mechanism
Lateral Movement	`T1550.001` Use Alternate Authentication Material: Application Access Token

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `GetSessionToken`: Returns temporary credentials for an IAM user, optionally requiring MFA authentication.

Rules detecting the same action

These rules filter on the same operation.

AWS Authentication From CrowdStrike Unmanaged Device (Panther)
AWS Authentication from CrowdStrike Unmanaged Device (Panther)
AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) (Panther)
AWS STS GetSessionToken by IAM User (Panther)
AWS STS GetSessionToken Usage (Elastic)

Rule body

title: AWS STS GetSessionToken Misuse
id: b45ab1d2-712f-4f01-a751-df3826969807
status: test
description: Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.
references:
    - https://github.com/elastic/detection-rules/pull/1213
    - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html
author: Austin Songer @austinsonger
date: 2021-07-24
modified: 2022-10-09
tags:
    - attack.lateral-movement
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1550
    - attack.t1550.001
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: sts.amazonaws.com
        eventName: GetSessionToken
        userIdentity.type: IAMUser
    condition: selection
falsepositives:
    - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: sts.amazonaws.com
    eventName: GetSessionToken
    userIdentity.type: IAMUser

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`GetSessionToken`	`field:"aws::eventName" kind:eq value:"GetSessionToken"`
`eventSource`	eq	`sts.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"sts.amazonaws.com"`
`userIdentity.type`	eq	`IAMUser`	`field:"aws::userIdentity.type" kind:eq value:"IAMUser"`