Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - STS Token Suspicious Activity from Kubernetes Worker Node

Identifies STS token usage from an EKS-hosted EC2 instance that originates outside AWS IP ranges, which may indicate token hijacking via SSRF or credential theft.

ATT&CK coverage

Outside the enterprise matrix

T1528Steal Application Access Token 62 detections cover this technique
T1550.001Application Access Token 49 detections cover this technique

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

CredentialAccessLateralMovement

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.