AWS Access Key

Free

IAM access key that alerts on API usage

Type

Persistent

Detection

Instant

MITRE ATT&CK

PersistenceCredential AccessCollection

Tags

awsidentityaccessops+1

max 10 tokens

AWS Bedrock Key

Free

Bedrock service-specific credentials that alert on AI/ML API usage

Type

Persistent

Detection

Instant

MITRE ATT&CK

PersistenceCredential Access

Tags

awsaiapiops

max 2 tokens

AWS Bedrock Bearer Token

Pro

AWS Bedrock bearer token

Type

Ephemeral

Detection

Instant

MITRE ATT&CK

Persistence

Tags

awsaiapiephemeral

AWS DSQL Token

Pro

Ephemeral Aurora DSQL connection token (36 hours)

Type

Ephemeral

Detection

<1min

MITRE ATT&CK

PersistenceCredential AccessCollection

Tags

awsdatabaseephemeral

AWS ECR Token

Pro

Ephemeral container registry token (12 hours)

Type

Ephemeral

Detection

Instant

MITRE ATT&CK

PersistenceCollection

Tags

awscontainerephemeral

AWS Federation Token

Pro

Ephemeral federated session credentials (15min - 36hr)

Type

Ephemeral

Detection

Instant

MITRE ATT&CK

PersistenceDefense Evasion

Tags

awsidentityephemeral

AWS Presigned URL

Pro

Ephemeral S3 object access URL (up to 7 days)

Type

Ephemeral

Detection

Instant

MITRE ATT&CK

PersistenceCollectionExfiltration

Tags

awsstorageephemeral

AWS RDS MySQL User

Pro

MySQL user that alerts on connection attempts

Type

Persistent

Detection

<1min

MITRE ATT&CK

PersistenceCredential AccessCollection

Tags

awsdatabaseops

AWS RDS Postgres User

Pro

PostgreSQL user that alerts on connection attempts

Type

Persistent

Detection

<1min

MITRE ATT&CK

PersistenceCredential AccessCollection

Tags

awsdatabaseops

AWS S3 Bucket

Free

S3 bucket that alerts on access

Type

Persistent

Detection

Instant

MITRE ATT&CK

DiscoveryReconnaissance

Tags

awsstorageops

max 2 tokens

AWS Session Token

Pro

Ephemeral session credentials (15min - 36hr)

Type

Ephemeral

Detection

Instant

MITRE ATT&CK

PersistenceDefense EvasionCredential Access

Tags

awsidentityephemeral

AWS User Credential

Pro

IAM console login credentials that alert on sign-in

Type

Persistent

Detection

Instant

MITRE ATT&CK

PersistenceCredential Access

Tags

awsidentityaccess

Azure Service Principal

Pro

Service principal that alerts on authentication

Type

Persistent

Detection

<1min

MITRE ATT&CK

PersistenceDefense EvasionCredential Access

Tags

azureidentityautomationops

CrowdStrike API Key

Pro

CrowdStrike API credentials that alert on usage

Type

Persistent

Detection

<5min

MITRE ATT&CK

PersistenceCredential AccessCollection

Tags

crowdstrikesecurityapi

SSH Private Key

Free

SSH key that alerts on authentication attempts

Type

Persistent

Detection

Instant

MITRE ATT&CK

Lateral MovementCredential AccessPersistence

Tags

sshaccesslateral-movementops+1

max 20 tokens

Web Clone Token

Pro

Web resource that alerts on access from unexpected domains

Type

Persistent

Detection

Instant

MITRE ATT&CK

Resource DevelopmentInitial Access

Tags

webphishingbrand-protection