AWS STS GetCallerIdentity Bulk Account Enumeration

Description

Identifies three or more distinct AWS principals calling STS "GetCallerIdentity" from the same source IP and autonomous system within a 10-minute window. "GetCallerIdentity" returns the account and identity behind a credential and requires no permissions, so a burst of different non-role identities from one external address is a common credential-validation and account-enumeration step. Assumed roles, Vault OIDC users, and calls from major cloud and carrier networks are excluded.

Query · esql

from logs-aws.cloudtrail-*
| where KQL("""data_stream.dataset: "aws.cloudtrail" and event.provider: "sts.amazonaws.com" and event.action: "GetCallerIdentity" and event.outcome: "success" and not aws.cloudtrail.user_identity.type: "AssumedRole" and source.as.organization.name: * and not user.name: vault-oidc-*""")
  and source.ip is not null
  and not source.as.organization.name in (
    "Amazon.com, Inc.",
    "AMAZON-02",
    "AMAZON-AES",
    "Google LLC",
    "Microsoft Corporation",
    "Verizon Business",
    "AT&T Enterprises, LLC"
  )
| stats
    Esql.aws_cloudtrail_user_identity_arn_count_distinct = count_distinct(aws.cloudtrail.user_identity.arn),
    Esql.user_name_count_distinct = count_distinct(user.name),
    Esql.user_name_values = values(user.name),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.aws_cloudtrail_user_identity_arn_values = values(aws.cloudtrail.user_identity.arn)
  by source.ip, source.as.organization.name
| where Esql.user_name_count_distinct >= 3
| keep
    Esql.user_name_count_distinct,
    Esql.aws_cloudtrail_user_identity_arn_count_distinct,
    source.ip,
    source.as.organization.name,
    Esql.user_name_values,
    Esql.user_agent_original_values,
    Esql.aws_cloudtrail_user_identity_arn_values

Investigation fields

Pivot points the source recommends for triage.

  • Esql.user_name_count_distinct
  • Esql.aws_cloudtrail_user_identity_arn_count_distinct
  • source.ip
  • source.as.organization.name
  • Esql.user_name_values
  • Esql.user_agent_original_values
  • Esql.aws_cloudtrail_user_identity_arn_values

Implementation guide

The AWS integration must collect CloudTrail management events into logs-aws.cloudtrail-*. GetCallerIdentity is a management event logged by default. source.as.organization.name must be populated, because events missing it are excluded.

Known false positives

  • A corporate NAT, jump host, or CI runner that is not in the excluded ASN list can send `GetCallerIdentity` for several IAM users from one IP. Confirm the source IP, user agent, and user list against approved automation before treating the activity as malicious.

Analyst notes

Investigating AWS STS GetCallerIdentity Bulk Account Enumeration

GetCallerIdentity returns the account and principal for the credentials that called it. No IAM permission is required. This rule groups successful calls that are not AssumedRole by source IP and source ASN. It alerts when that group contains at least three distinct user.name values. The rule runs every 5 minutes and looks back 10 minutes, so the threshold is the last 10 minutes of activity. Alerts for the same source.ip are suppressed for 24 hours.

This complements AWS STS GetCallerIdentity API Called for the First Time, which alerts on the first call from one identity. This rule alerts when several identities are checked from one external address.

Possible investigation steps

  • Review source.ip, source.as.organization.name, and Esql.user_agent_original_values. An AWS CLI, SDK, or unknown client from an unfamiliar ASN is higher priority than a known management host.
  • Review Esql.user_name_values and Esql.aws_cloudtrail_user_identity_arn_values. Check whether the identities are unrelated IAM users, include privileged users, or share one access key.
  • Compare Esql.user_name_count_distinct with Esql.aws_cloudtrail_user_identity_arn_count_distinct. A higher ARN count than user count can mean several keys or federation sessions for the same user names.
  • Search CloudTrail for those identities in the surrounding hour for AssumeRole, GetSessionToken, IAM changes, and discovery calls such as ListUsers, ListBuckets, and DescribeInstances.
  • Determine whether any of the credentials were used successfully after the identity check.

False positive analysis

  • Users named vault-oidc-* are excluded.
  • AssumedRole sessions are excluded. IAM users, federated users, and the root user remain in scope.
  • Calls whose source ASN is Amazon, Google, Microsoft, Verizon, or AT&T are excluded.
  • Shared egress that is not in that ASN list can still reach three users. Exclude the source IP or user agent when the behavior is documented.

Response and remediation

  • If the activity is not authorized, disable the access keys for the listed users and revoke active sessions.
  • Rotate credentials that were validated from the source IP.
  • Review CloudTrail for follow-on use of those identities and contain any resources they touched.
Raw source AWS STS GetCallerIdentity Bulk Account Enumeration · Elastic TOML
Esc
Published by elastic/detection-rules ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[metadata]
creation_date = "2026/11/02"
integration = ["aws"]
maturity = "production"
updated_date = "2026/11/02"

[rule]
author = ["Elastic"]
description = """
Identifies three or more distinct AWS principals calling STS "GetCallerIdentity" from the same source IP and
autonomous system within a 10-minute window. "GetCallerIdentity" returns the account and identity behind a credential
and requires no permissions, so a burst of different non-role identities from one external address is a common
credential-validation and account-enumeration step. Assumed roles, Vault OIDC users, and calls from major cloud and
carrier networks are excluded.
"""
false_positives = [
    """
    A corporate NAT, jump host, or CI runner that is not in the excluded ASN list can send `GetCallerIdentity` for
    several IAM users from one IP. Confirm the source IP, user agent, and user list against approved automation
    before treating the activity as malicious.
    """,
]
from = "now-10m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "AWS STS GetCallerIdentity Bulk Account Enumeration"
note = """## Triage and analysis

### Investigating AWS STS GetCallerIdentity Bulk Account Enumeration

`GetCallerIdentity` returns the account and principal for the credentials that called it. No IAM permission is
required. This rule groups successful calls that are not `AssumedRole` by source IP and source ASN. It alerts when
that group contains at least three distinct `user.name` values. The rule runs every 5 minutes and looks back 10
minutes, so the threshold is the last 10 minutes of activity. Alerts for the same `source.ip` are suppressed for
24 hours.

This complements **AWS STS GetCallerIdentity API Called for the First Time**, which alerts on the first call from
one identity. This rule alerts when several identities are checked from one external address.

### Possible investigation steps

- Review `source.ip`, `source.as.organization.name`, and `Esql.user_agent_original_values`. An AWS CLI, SDK, or
  unknown client from an unfamiliar ASN is higher priority than a known management host.
- Review `Esql.user_name_values` and `Esql.aws_cloudtrail_user_identity_arn_values`. Check whether the identities
  are unrelated IAM users, include privileged users, or share one access key.
- Compare `Esql.user_name_count_distinct` with `Esql.aws_cloudtrail_user_identity_arn_count_distinct`. A higher ARN
  count than user count can mean several keys or federation sessions for the same user names.
- Search CloudTrail for those identities in the surrounding hour for `AssumeRole`, `GetSessionToken`, IAM changes,
  and discovery calls such as `ListUsers`, `ListBuckets`, and `DescribeInstances`.
- Determine whether any of the credentials were used successfully after the identity check.

### False positive analysis

- Users named `vault-oidc-*` are excluded.
- `AssumedRole` sessions are excluded. IAM users, federated users, and the root user remain in scope.
- Calls whose source ASN is Amazon, Google, Microsoft, Verizon, or AT&T are excluded.
- Shared egress that is not in that ASN list can still reach three users. Exclude the source IP or user agent when
  the behavior is documented.

### Response and remediation

- If the activity is not authorized, disable the access keys for the listed users and revoke active sessions.
- Rotate credentials that were validated from the source IP.
- Review CloudTrail for follow-on use of those identities and contain any resources they touched.
"""
references = [
    "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html",
    "https://www.secureworks.com/research/detecting-the-use-of-stolen-aws-lambda-credentials",
    "https://detectioninthe.cloud/ttps/discovery/sts_get_caller_identity",
]
risk_score = 73
rule_id = "dad4a0c7-f529-4d3d-b4f0-a2c97b8f7dfa"
setup = """## Setup

The AWS integration must collect CloudTrail management events into `logs-aws.cloudtrail-*`.
`GetCallerIdentity` is a management event logged by default. `source.as.organization.name` must be populated,
because events missing it are excluded.
"""
severity = "high"
tags = [
    "Domain: Cloud",
    "Data Source: AWS",
    "Data Source: Amazon Web Services",
    "Data Source: AWS CloudTrail",
    "Platform: AWS",
    "Service: AWS STS",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Resources: Investigation Guide",
    "Rule Type: ES|QL",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-aws.cloudtrail-*
| where KQL("""data_stream.dataset: "aws.cloudtrail" and event.provider: "sts.amazonaws.com" and event.action: "GetCallerIdentity" and event.outcome: "success" and not aws.cloudtrail.user_identity.type: "AssumedRole" and source.as.organization.name: * and not user.name: vault-oidc-*""")
  and source.ip is not null
  and not source.as.organization.name in (
    "Amazon.com, Inc.",
    "AMAZON-02",
    "AMAZON-AES",
    "Google LLC",
    "Microsoft Corporation",
    "Verizon Business",
    "AT&T Enterprises, LLC"
  )
| stats
    Esql.aws_cloudtrail_user_identity_arn_count_distinct = count_distinct(aws.cloudtrail.user_identity.arn),
    Esql.user_name_count_distinct = count_distinct(user.name),
    Esql.user_name_values = values(user.name),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.aws_cloudtrail_user_identity_arn_values = values(aws.cloudtrail.user_identity.arn)
  by source.ip, source.as.organization.name
| where Esql.user_name_count_distinct >= 3
| keep
    Esql.user_name_count_distinct,
    Esql.aws_cloudtrail_user_identity_arn_count_distinct,
    source.ip,
    source.as.organization.name,
    Esql.user_name_values,
    Esql.user_agent_original_values,
    Esql.aws_cloudtrail_user_identity_arn_values
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"

[[rule.threat.technique]]
id = "T1033"
name = "System Owner/User Discovery"
reference = "https://attack.mitre.org/techniques/T1033/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"

[rule.investigation_fields]
field_names = [
    "Esql.user_name_count_distinct",
    "Esql.aws_cloudtrail_user_identity_arn_count_distinct",
    "source.ip",
    "source.as.organization.name",
    "Esql.user_name_values",
    "Esql.user_agent_original_values",
    "Esql.aws_cloudtrail_user_identity_arn_values",
]

[rule.alert_suppression]
group_by = ["source.ip"]
missing_fields_strategy = "suppress"

[rule.alert_suppression.duration]
unit = "h"
value = 24

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.