attack.t1550 | Detection.FYI

AWS STS AssumeRole Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Read More
AWS STS GetSessionToken Misuse

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.t1548 attack.t1550 attack.t1550.001 ·
Share on:

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Read More
AWS Suspicious SAML Activity

Aug 12, 2024 · attack.initial-access attack.t1078 attack.lateral-movement attack.t1548 attack.privilege-escalation attack.t1550 attack.t1550.001 ·
Share on:

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read More
Outgoing Logon with New Credentials

Aug 12, 2024 · attack.defense-evasion attack.lateral-movement attack.t1550 ·
Share on:

Detects logon events that specify new credentials

Read More