Suspicious activity of STS token related to Glue

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Suspicious activity of the STS token of a Glue endpoint machine hosted by ECS (for example, by SSRF) indicates a possible token hijacking. An attacker may have stolen the token and could abuse its permissions to escalate privileges and move laterally in the cloud account.

Attribute Value
Type Hunting Query
Solution Amazon Web Services
ID 0cd3eb95-6c8e-4eeb-8338-a0decdc0a328
Severity High
Tactics Credential Access
Techniques T1528
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
AWSCloudTrail ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Hunting Queries · Back to Amazon Web Services