Exploring AWS STS AssumeRoot — Elastic Security Labs
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Abuse Elevation Control Mechanism - T1626 Abuse Elevation Control Mechanism - T1548 Additional Cloud Roles - T1098.003 Cloud Accounts - T1078.004 Cloud Accounts - T1585.003 Cloud Accounts - T1586.003 Credentials - T1589.001 Malware - T1587.001 Malware - T1588.001 Phishing - T1660 Phishing - T1566 Python - T1059.006 Web Service - T1481 Temporary Elevated Cloud Access - T1548.005 Tool - T1588.002 Account Manipulation - T1098 Valid Accounts - T1078 Web Service - T1102 Valid Accounts
Show in Graph
Common Information
Type Value
UUID 61dbcc10-4812-4293-9017-c12134fb8b5c
Fingerprint a63043d10c82d105
Analysis status DONE
Considered CTI value 2
Text language
Published Dec. 9, 2024, midnight
Added to db Dec. 10, 2024, 2:30 p.m.
Last updated Dec. 23, 2024, 3:09 p.m.
Headline Exploring AWS STS AssumeRoot
Title Exploring AWS STS AssumeRoot — Elastic Security Labs
Detected Hints/Tags/Attributes 60/2/15
Source URLs
Redirection Url
Details Source https://www.elastic.co/security-labs/exploring-aws-sts-assumeroot
URL Provider
Details Provider Source level domain
Details elastic.co www.elastic.co
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 306 ✔ Elastic Security Labs https://www.elastic.co/security-labs/rss/feed.xml 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 15 
sts.amazonaws.com
Details Domain 15 
main.tf
Details Domain 3 
outputs.tf
Details Domain 90 
amazonaws.com
Details Domain 17 
iam.amazonaws.com
Details Domain 2 
cloud.account.id
Details Domain 21 
user.id
Details File 3 
var.reg
Details File 28 
event.dat
Details File 6 
source.geo
Details MITRE ATT&CK Techniques 38 
T1078.004
Details MITRE ATT&CK Techniques 1 
T1548.005
Details MITRE ATT&CK Techniques 9 
T1098.003
Details Url 1 
https://sts.{region}.amazonaws.com
Details Url 1 
https://sts.<region>.amazonaws.com