Anonymous AWS Token Grab Followed by Token Mint (Cross-Destination Pivot Aware)
Detects a sequence of activity where an anonymous AWS token is requested via a specific API path, followed within 15 minutes by a token minting call from the same source IP. This behavior is indicative of a token-theft or privilege escalation chain.
Microsoft Sentinel (KQL)
