AWS CloudTrail STS GetCallerIdentity User-Agent TruffleHog Enumeration

Identifies TruffleHog-labeled STS GetCallerIdentity calls in AWS CloudTrail, indicating possible AWS key validation or enumeration.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-sts-getcalleridentity-user-agent-trufflehog-enumeration-9b1b8e9b

title: AWS CloudTrail STS GetCallerIdentity User-Agent TruffleHog Enumeration
id: 61ab5def-05f1-4244-b9b1-3d3fefaf7871
status: experimental
description: This rule flags AWS CloudTrail events where the STS GetCallerIdentity API call is made and the request userAgent contains "TruffleHog." It matters because automated tooling like TruffleHog is often used to test whether exposed or suspected AWS keys are valid before attempting further activity. The detection relies on CloudTrail telemetry fields including eventSource, eventName, and userAgent.
references:
  - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
  - https://github.com/trufflesecurity/trufflehog
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml
author: Adan Alvarez @adanalvarez, Huntrule Team
date: 2025-10-12
tags:
  - attack.discovery
  - attack.t1087.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: sts.amazonaws.com
    eventName: GetCallerIdentity
    userAgent|contains: TruffleHog
  condition: selection
falsepositives:
  - Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.
level: medium
license: DRL-1.1
related:
  - id: 9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d
    type: derived

What it detects

This rule flags AWS CloudTrail events where the STS GetCallerIdentity API call is made and the request userAgent contains "TruffleHog." It matters because automated tooling like TruffleHog is often used to test whether exposed or suspected AWS keys are valid before attempting further activity. The detection relies on CloudTrail telemetry fields including eventSource, eventName, and userAgent.

Known false positives

Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.