AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent
Identifies TruffleHog-labeled STS GetCallerIdentity calls in AWS CloudTrail, indicating possible AWS key validation or enumeration.
- Product
- aws
- Service
- cloudtrail
- Author
- Adan Alvarez @adanalvarez (SigmaHQ), DRL 1.1
- Published
- 2025-10-12
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies AWS STS GetCallerIdentity API calls in CloudTrail where the event originates from sts.amazonaws.com and the userAgent contains "TruffleHog." It flags this behavior because TruffleHog can be used to enumerate and validate potentially exposed AWS credentials by confirming whether they authenticate successfully. Detection relies on CloudTrail fields for eventSource, eventName, and userAgent.
Reporting behind it
- rapid7.comhttps://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
- docs.aws.amazon.comhttps://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
- github.comhttps://github.com/trufflesecurity/trufflehog
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS CloudTrail Detects STS GetCallerIdentity Calls with TruffleHog User-Agent
id: 61ab5def-05f1-4244-b9b1-3d3fefaf7871
status: experimental
description: This rule identifies AWS STS GetCallerIdentity API calls in CloudTrail where the event originates from sts.amazonaws.com and the userAgent contains "TruffleHog." It flags this behavior because TruffleHog can be used to enumerate and validate potentially exposed AWS credentials by confirming whether they authenticate successfully. Detection relies on CloudTrail fields for eventSource, eventName, and userAgent.
references:
- https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
- https://github.com/trufflesecurity/trufflehog
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml
author: Adan Alvarez @adanalvarez, Huntrule Team
date: 2025-10-12
tags:
- attack.discovery
- attack.t1087.004
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: sts.amazonaws.com
eventName: GetCallerIdentity
userAgent|contains: TruffleHog
condition: selection
falsepositives:
- Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.
level: medium
license: DRL-1.1
related:
- id: 9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d
type: derived