title: AWS STS GetCallerIdentity Credential Validation
id: 2f0b7c3e-6a41-4c1e-9b8a-1d2e3f4a5b04
status: experimental
description: GetCallerIdentity is commonly the first call made with stolen keys. Correlate with source IPs not in your baseline or egress ranges.
references:
    - https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access
author: Defensive detection pack
date: 2026-10-22
tags:
    - attack.discovery
    - attack.t1087.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: sts.amazonaws.com
        eventName: GetCallerIdentity
    condition: selection
falsepositives:
    - SDKs, CLIs and CI frequently call this
level: informational