AWS Access Key
FreeIAM access key that alerts on API usage
Type
PersistentDetection
InstantMITRE ATT&CK
Tags
max 10 tokens
AWS Bedrock Key
FreeBedrock service-specific credentials that alert on AI/ML API usage
Type
PersistentDetection
InstantMITRE ATT&CK
Tags
max 2 tokens
AWS Bedrock Bearer Token
ProAWS Bedrock bearer token
Type
EphemeralDetection
InstantMITRE ATT&CK
Tags
AWS DSQL Token
ProEphemeral Aurora DSQL connection token (36 hours)
Type
EphemeralDetection
<1minMITRE ATT&CK
Tags
AWS ECR Token
ProEphemeral container registry token (12 hours)
Type
EphemeralDetection
InstantMITRE ATT&CK
Tags
AWS Federation Token
ProEphemeral federated session credentials (15min - 36hr)
Type
EphemeralDetection
InstantMITRE ATT&CK
Tags
AWS Presigned URL
ProEphemeral S3 object access URL (up to 7 days)
Type
EphemeralDetection
InstantMITRE ATT&CK
Tags
AWS RDS MySQL User
ProMySQL user that alerts on connection attempts
Type
PersistentDetection
<1minMITRE ATT&CK
Tags
AWS RDS Postgres User
ProPostgreSQL user that alerts on connection attempts
Type
PersistentDetection
<1minMITRE ATT&CK
Tags
AWS S3 Bucket
FreeS3 bucket that alerts on access
Type
PersistentDetection
InstantMITRE ATT&CK
Tags
max 2 tokens
AWS Session Token
ProEphemeral session credentials (15min - 36hr)
Type
EphemeralDetection
InstantMITRE ATT&CK
Tags
AWS User Credential
ProIAM console login credentials that alert on sign-in
Type
PersistentDetection
InstantMITRE ATT&CK
Tags
Azure Service Principal
ProService principal that alerts on authentication
Type
PersistentDetection
<1minMITRE ATT&CK
Tags
CrowdStrike API Key
ProCrowdStrike API credentials that alert on usage
Type
PersistentDetection
<5minMITRE ATT&CK
Tags
SSH Private Key
FreeSSH key that alerts on authentication attempts
Type
PersistentDetection
InstantMITRE ATT&CK
Tags
max 20 tokens
Web Clone Token
ProWeb resource that alerts on access from unexpected domains
Type
PersistentDetection
InstantMITRE ATT&CK
Tags