AWS OIDC role assumption from ci-sync branch followed by Secrets Manager access

ills3c Intel&Coffee@Ills3C

•updated yesterday•2•0•4

Detects AWS OIDC role assumption by a GitHub workflow running on a ci-sync-<6 chars> branch followed within an hour by Secrets Manager reads using the same session credentials, as seen in the Gheist campaign.