AWS Credential Abuse via MCP Process - GetCallerIdentity and Suspicious IAM Activity

Ibrahim Saud@tektrix

•updated Jun 26, 2026•1•0•4

Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.