AWS CloudTrail: IAMUser GetSessionToken Activity

Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.

FreeUnreviewedSigmalowv1

aws-cloudtrail-iamuser-getsessiontoken-activity-b45ab1d2

title: "AWS CloudTrail: IAMUser GetSessionToken Activity"
id: f3ebeae9-564a-42aa-a10d-0e5ba58efe2a
status: test
description: This rule flags AWS STS GetSessionToken events in CloudTrail where the caller is an IAM user. Attackers can use session tokens to obtain temporary credentials for subsequent access, supporting lateral movement and potential privilege escalation. The detection relies on CloudTrail fields for eventSource, eventName, and userIdentity.type.
references:
  - https://github.com/elastic/detection-rules/pull/1213
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.t1548
  - attack.t1550
  - attack.t1550.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: sts.amazonaws.com
    eventName: GetSessionToken
    userIdentity.type: IAMUser
  condition: selection
falsepositives:
  - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: b45ab1d2-712f-4f01-a751-df3826969807
    type: derived

What it detects

This rule flags AWS STS GetSessionToken events in CloudTrail where the caller is an IAM user. Attackers can use session tokens to obtain temporary credentials for subsequent access, supporting lateral movement and potential privilege escalation. The detection relies on CloudTrail fields for eventSource, eventName, and userIdentity.type.

Known false positives

GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.