Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS EC2 Role GetCallerIdentity from New Source AS Organization

Identifies the first time an EC2 instance role session calls AWS STS GetCallerIdentity from a given source autonomous system (AS) organization name within the lookback window. Adversaries who steal instance role credentials often verify them with GetCallerIdentity from infrastructure outside your normal egress paths. Baseline learning on the pairing of identity and source network reduces noise from stable NAT or AWS-classified egress compared to alerting on every call from a non-Amazon ASN.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

New EC2 workloads, NAT or egress changes, ISP renumbering, or GeoIP database updates can change `source.as.organization.name` for the same logical path. Roles that legitimately call STS from many networks (for example, developer-exported temporary credentials) may also produce alerts. Tune using role ARN, account, or user agent where appropriate.

References

Tagged by the source as

Data Source: Amazon Web ServicesData Source: AWSData Source: AWS STSDomain: CloudDomain: IdentityResources: Investigation GuideTactic: DiscoveryUse Case: Identity and Access AuditUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

AWS EC2 Role GetCallerIdentity from New Source AS Organization