Sigma rule: AWS STS GetCallerIdentity Enumeration Via TruffleHog

Rule

Title

AWS STS GetCallerIdentity Enumeration Via TruffleHog

Status

experimental

Level

medium

Author

Adan Alvarez @adanalvarez

Date

2025-10-12

File

rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog.
Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys.
Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'GetCallerIdentity'
    userAgent|contains: 'TruffleHog'
condition: selection

False positives (as the rule lists them)

• Legitimate internal security scanning or key validation that intentionally uses TruffleHog. Authorize and filter known scanner roles, IP ranges, or assumed roles as needed.

Tags

• attack.discovery
• attack.t1087.004

MITRE ATT&CK ids this rule names

• T1087.004

References

• https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
• https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
• https://github.com/trufflesecurity/trufflehog

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml