Possible AWS STS GetCallerIdentity Enumeration Through TruffleHog (via cloudtrail)

title: Possible AWS STS GetCallerIdentity Enumeration Through TruffleHog (via cloudtrail)
id: 64c20a05-5009-5902-837b-f6b18af41b29
status: stable
description: This rule detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent suggests TruffleHog. Threat actors abuse TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation enables threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
references:
    - https://attack.mitre.org/techniques/T1087/004/
    - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
    - https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
    - https://github.com/trufflesecurity/trufflehog
author: Huntrule Team
date: 2026-03-03
tags:
    - attack.discovery
    - attack.t1087.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'sts.amazonaws.com'
        eventName: 'GetCallerIdentity'
        userAgent|contains: 'TruffleHog'
    condition: selection
falsepositives:
    - Unknown
level: medium