AWS STS GetSessionToken Misuse

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.