AWS STS GetCallerIdentity Enumeration Via TruffleHog

Adan Alvarez @adanalvarez

Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.

2025-10-12 00:00:00

None

9b1b8e9b-0a5d-4af1-9d2f-4c4b6e7c2c9d

attack.discovery attack.t1087.004

Community Rule

Adan Álvarez

Merge PR #5688 from @adanalvarez - AWS STS GetCallerIdentity Enumeration Via TruffleHog

2025-10-23