AWS CloudTrail: IAMUser STS GetSessionToken Use

Alerts on CloudTrail STS GetSessionToken calls made by IAM users, indicating potential temporary credential misuse.

FreeReviewedSigma · Low · v5

Product: aws
Service: cloudtrail
Author: Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published: 2021-07-24
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1548Abuse Elevation Control Mechanism
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1550Use Alternate Authentication Material
- T1550.001Application Access Token
Collection
C2
Exfiltration
Impact

What it detects

This rule flags CloudTrail events where an IAM user calls the STS GetSessionToken API. Attackers can use session tokens to obtain temporary credentials that may enable lateral movement or privilege escalation. It relies on telemetry from AWS CloudTrail, specifically matching eventSource sts.amazonaws.com, eventName GetSessionToken, and userIdentity.type equal to IAMUser.

Reporting behind it

Related detections9 linkedT1550.001 — drag to rearrange

AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates

AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

Malicious GCP Service Account Backdoor via serviceAccountTokenCreator Grant

Suspicious GCP Service Account Impersonation via GenerateAccessToken

Malicious Azure Elevate Access to User Access Administrator

Suspicious AWS Role Assumption via Cognito Web Identity

Suspicious Kubernetes Service Account Token Generation via kubectl

Suspicious browsercore Execution from Anomalous Parent for PRT Cookie (via process_creation)

AWS CloudTrail: IAMUser STS GetSessionToken Use

Pivot detection · T1550.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-iamuser-getsessiontoken-activity-b45ab1d2

title: "AWS CloudTrail: IAMUser STS GetSessionToken Use"
id: f3ebeae9-564a-42aa-a10d-0e5ba58efe2a
status: test
description: This rule flags CloudTrail events where an IAM user calls the STS GetSessionToken API. Attackers can use session tokens to obtain temporary credentials that may enable lateral movement or privilege escalation. It relies on telemetry from AWS CloudTrail, specifically matching eventSource sts.amazonaws.com, eventName GetSessionToken, and userIdentity.type equal to IAMUser.
references:
  - https://github.com/elastic/detection-rules/pull/1213
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.t1548
  - attack.t1550
  - attack.t1550.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: sts.amazonaws.com
    eventName: GetSessionToken
    userIdentity.type: IAMUser
  condition: selection
falsepositives:
  - GetSessionToken may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. GetSessionToken from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: b45ab1d2-712f-4f01-a751-df3826969807
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL