BeepRAT/MCP aws sts get-caller-identity credential exfil via curl

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects potential unauthorized access to AWS credentials by monitoring process creation events involving the 'get-caller-identity' command. It identifies scenarios where AWS access key environment variables are accessed or manipulated, and monitors common shell or node processes executing commands to query AWS identity information, which may indicate credential exfiltration or reconnaissance by an attacker.