Browse Rules

AWS Potentially Stolen Service Role

A role was assumed by an AWS service, followed by a user within 24 hours. This could indicate a stolen or compromised AWS service role.

[AWS-STS] Security Token Service event detected (AssumeRoleWithSAML)

[AWS-STS] Security Token Service event detected (AssumeRoleWithSAML)

[AWS-STS] Security Token Service event detected (AssumeRoleWithWebIdentity)

[AWS-STS] Security Token Service event detected (AssumeRoleWithWebIdentity)

[AWS-STS] Security Token Service event detected (DecodeAuthorizationMessage)

[AWS-STS] Security Token Service event detected (DecodeAuthorizationMessage)

[AWS-STS] Security Token Service event detected (GetAccessKeyInfo)

[AWS-STS] Security Token Service event detected (GetAccessKeyInfo)

[AWS-STS] Security Token Service event detected (GetFederationToken)

[AWS-STS] Security Token Service event detected (GetFederationToken)

[AWS-STS] Security Token Service event detected (GetSessionToken)

[AWS-STS] Security Token Service event detected (GetSessionToken)

AWS Config Service Modified

Detects when AWS Config Service is updated, stopped or deleted.

[AWS-STS] Security Token Service Discovery Command Event Detected (GetCallerIdentity)

[AWS-STS] Security Token Service Discovery Command Event Detected (GetCallerIdentity)

AWS Storage Enumeration [snowflake-awscloudtrail]

Identify commands associated with enumerating storage services like S3 in AWS -- Threat Actor Association: GUI-vil

AWS Storage Enumeration [splunk-awscloudtrail]

Identify commands associated with enumerating storage services like S3 in AWS -- Threat Actor Association: GUI-vil

AWS STS Role Assumption by Service

Identifies when a service has assumed a role in AWS Security Token Service (STS). Services can assume a role to obtain temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege escalation. This is a New Terms rule that identifies when a service assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS resources. While often legitimate, adversaries may use this technique for unauthorized access, p

AWS CloudFormation Stack IAM Service Role

Associating IAM roles with CloudFormation stacks ensures least privilege when making changes to your account.

Deprecated - AWS RDS Instance/Cluster Stoppage

Identifies that an Amazon Relational Database Service (RDS) cluster or instance has been stopped.

Multiple Service Logging Deleted or Stopped

This hunting query identifies the deletion or stopping of multiple service logging actions within AWS. Service logging is a critical security control that provides visibility into the activities and changes within AWS services. Adversaries may attempt to disable or delete service logging to evade detection and cover their tracks. Monitoring for multiple service logging deletions or stops can help identify potential malicious activity and ensure that critical security controls remain intact.

AWS STS Role Assumption by User

Identifies when a user or role has assumed a role in AWS Security Token Service (STS). Users can assume a role to obtain temporary credentials and access AWS resources. Adversaries can use this technique for credential access and privilege escalation. This is a New Terms rule that identifies when a user assumes a role in AWS Security Token Service (STS) to obtain temporary credentials and access AWS resources. While often legitimate, adversaries may use this technique for unauthorized access, pr

AWS GetFederationToken Followed by Console Login via Federation Exchange

Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was opened — all from the same source IP within two minutes. This sequence is a high-confidence indicator of credential abuse using stole

AWS Configuration Recorder Stopped

Identifies when an AWS Config configuration recorder is stopped. AWS Config recorders continuously track and record configuration changes across supported AWS resources. Stopping the recorder immediately reduces visibility into infrastructure changes and can be abused by adversaries to evade detection, obscure follow-on activity, or weaken compliance and security monitoring controls.

AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN

Detects successful `AssumeRoleWithWebIdentity` where the caller identity is a Kubernetes service account and the source autonomous system organization is present but not `Amazon.com, Inc.` EKS workloads that obtain IAM credentials via IAM Roles for Service Accounts (IRSA) normally reach STS from AWS-managed or AWS-associated networks; the same identity from a clearly external ASN can indicate a stolen or misused projected service-account token being exchanged for IAM credentials off-cluster.

AWS STS AssumeRole with New MFA Device

Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS). While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.

AWS IMDS Credential Usage Outside Expected Services

Detects when an EC2 instance identity (credentials obtained via IMDS) is used to make API calls outside of expected internal AWS services like SSM. This indicates that IMDS credentials may have been exfiltrated from a compromised instance and are being used externally for lateral movement or privilege escalation.

AWS Bedrock LLM Denial-of-Service or Resource Exhaustion

This hunting query identifies unusual spikes in token usage that may indicate malicious attempts to disrupt services. High token usage can strain system resources and degrade performance, aligning with tactics observed in DoS attacks.

AWS CloudTrail Log Suspended

Detects Cloudtrail logging suspension via StopLogging API. Stopping CloudTrail eliminates forward audit visibility and is a classic defense evasion step before sensitive changes or data theft. Investigate immediately and determine what occurred during the logging gap.

AWS Console GetSigninToken Potential Abuse

Detects GetSigninToken calls from non-SSO user agents. An adversary can use tools like aws_consoler to convert compromised CLI credentials into a federated console session, bypassing MFA requirements and obscuring the original access key. The GetSigninToken API creates temporary console access from STS temporary credentials.

AWS CloudWatch Log Stream Deletion

Detects the deletion of an Amazon CloudWatch log stream using the "DeleteLogStream" API. Deleting a log stream permanently removes its associated log events and may disrupt security visibility, break audit trails, or suppress forensic evidence. Adversaries may delete log streams to conceal malicious actions, impair monitoring pipelines, or remove artifacts generated during post-exploitation activity.