AWS STS Token Dump via CLI

Ibrahim Saud@tektrix

•updated Jun 20, 2026•2•0•15

Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.