Sunturai
Back to results
HighElastic detection rulesElastic

AWS STS GetCallerIdentity Bulk Account Enumeration

Identifies three or more distinct AWS principals calling STS "GetCallerIdentity" from the same source IP and autonomous system within a 10-minute window. "GetCallerIdentity" returns the account and identity behind a…

Description

Identifies three or more distinct AWS principals calling STS "GetCallerIdentity" from the same source IP and autonomous system within a 10-minute window. "GetCallerIdentity" returns the account and identity behind a credential and requires no permissions, so a burst of different non-role identities from one external address is a common credential-validation and account-enumeration step. Assumed roles, Vault OIDC users, and calls from major cloud and carrier networks are excluded.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
ESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Known benign triggers

  • A corporate NAT, jump host, or CI runner that is not in the excluded ASN list can send `GetCallerIdentity` for several IAM users from one IP. Confirm the source IP, user agent, and user list against approved automation before treating the activity as malicious.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice