Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS STS AssumeRole with New MFA Device

Identifies when a user has assumed a role using a new MFA device. Users can assume a role to obtain temporary credentials and access AWS resources using the AssumeRole API of AWS Security Token Service (STS). While a new MFA device is not always indicative of malicious behavior it should be verified as adversaries can use this technique for persistence and privilege escalation.

ATT&CK coverage

Initial Access

T1078Valid AccountsAlso under Persistence, Privilege Escalation, and Stealth.291 detections cover this technique
- T1078.004Cloud Accounts 180 detections cover this technique

Persistence

T1556Modify Authentication ProcessAlso under Defense Impairment and Credential Access.77 detections cover this technique
- T1556.006Multi-Factor Authentication 25 detections cover this technique

Privilege Escalation

T1548Abuse Elevation Control Mechanism 109 detections cover this technique

Lateral Movement

T1550Use Alternate Authentication Material64 detections cover this technique
- T1550.001Application Access Token 43 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.