Sagan informational stable other

[AWS-STS] Security Token Service Discovery Command Event Detected (GetCallerIdentity)

[AWS-STS] Security Token Service Discovery Command Event Detected (GetCallerIdentity)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-STS] Security Token Service Discovery Command Event Detected (GetCallerIdentity)"; program:sts.amazonaws.com; content:"eventName
| 22 3a 20 22
| GetCallerIdentity
| 22
| "; content: ! "AWSReservedSSO_AWSAdministratorAccess"; content: ! "AWSServiceRole"; content:!"terraform"; classtype:system-event; reference:url,https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/; reference:url,docs.aws.amazon.com/STS/latest/APIReference/welcome.html; sid:5015085; rev:3; metadata:mitre_tactic_id TA0007;)

Field Validations

Loading…

Comments (0)

Loading comments...