Tag: STS

STS

All events with tag STS.

Returns temporary security credentials for assuming an IAM role. Allows an entity (user, service, or account) to act with the role's permissions.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement

Techniques:

T1078.004

Tags:

AWS STS

Returns temporary credentials for a SAML-authenticated user to assume an IAM role, used in federated SSO scenarios.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement

Techniques:

T1078.004

Tags:

AWS STS

Returns temporary credentials for a user authenticated via an OIDC identity provider (e.g., Cognito, Google) to assume an IAM role.

Cloud Service: AWS - STS

Tactics:

Initial Access Privilege Escalation Lateral Movement

Techniques:

T1078.004

Tags:

AWS STS

Returns temporary security credentials for a federated user, optionally scoped to an inline IAM policy.

Cloud Service: AWS - STS

Tactics:

Credential Access Privilege Escalation Initial Access

Techniques:

T1528 T1078.004

Tags:

AWS STS

Returns temporary credentials for an IAM user, typically used to satisfy an MFA requirement for subsequent API calls.

Cloud Service: AWS - STS

Tactics:

Credential Access Privilege Escalation

Techniques:

T1078.004 T1528

Tags:

AWS STS