Techniques
Sample rules
AWS STS GetCallerIdentity Bulk Account Enumeration
- source: elastic
- technicques:
- T1033
- T1087
Description
Identifies three or more distinct AWS principals calling STS “GetCallerIdentity” from the same source IP and autonomous system within a 10-minute window. “GetCallerIdentity” returns the account and identity behind a credential and requires no permissions, so a burst of different non-role identities from one external address is a common credential-validation and account-enumeration step. Assumed roles, Vault OIDC users, and calls from major cloud and carrier networks are excluded.
Detection logic
from logs-aws.cloudtrail-*
| where KQL("""data_stream.dataset: "aws.cloudtrail" and event.provider: "sts.amazonaws.com" and event.action: "GetCallerIdentity" and event.outcome: "success" and not aws.cloudtrail.user_identity.type: "AssumedRole" and source.as.organization.name: * and not user.name: vault-oidc-*""")
and source.ip is not null
and not source.as.organization.name in (
"Amazon.com, Inc.",
"AMAZON-02",
"AMAZON-AES",
"Google LLC",
"Microsoft Corporation",
"Verizon Business",
"AT&T Enterprises, LLC"
)
| stats
Esql.aws_cloudtrail_user_identity_arn_count_distinct = count_distinct(aws.cloudtrail.user_identity.arn),
Esql.user_name_count_distinct = count_distinct(user.name),
Esql.user_name_values = values(user.name),
Esql.user_agent_original_values = values(user_agent.original),
Esql.aws_cloudtrail_user_identity_arn_values = values(aws.cloudtrail.user_identity.arn)
by source.ip, source.as.organization.name
| where Esql.user_name_count_distinct >= 3
| keep
Esql.user_name_count_distinct,
Esql.aws_cloudtrail_user_identity_arn_count_distinct,
source.ip,
source.as.organization.name,
Esql.user_name_values,
Esql.user_agent_original_values,
Esql.aws_cloudtrail_user_identity_arn_values