AWS Temporary Credential Token Exfiltrated

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.