All Detections

AWS WorkMail Phishing TruffleHog

avatar
Daniel Jeremiah@daniyyell
updated Feb 5, 202650162

Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns

YARA-L