Panther low experimental python

AWS STS GetSessionToken by IAM User

Detects an IAM user calling STS GetSessionToken to obtain temporary credentials. Attackers who have compromised long-term IAM credentials may use GetSessionToken to generate short-lived session tokens for lateral movement or to bypass IP-based policies that apply only to long-term credentials.

View Source

Detection Logic

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context


def rule(event):
    if not aws_cloudtrail_success(event):
        return False
    return (
        event.get("eventSource") == "sts.amazonaws.com"
        and event.get("eventName") == "GetSessionToken"
        and event.deep_get("userIdentity", "type") == "IAMUser"
    )


def title(event):
    user = event.deep_get("userIdentity", "userName", default="<unknown>")
    account = event.get("recipientAccountId", "<unknown>")
    return f"IAM user [{user}] called GetSessionToken in account [{account}]"


def alert_context(event):
    return aws_rule_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...