Remote usage of an AWS service token

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2026-06-15

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Lateral Movement (TA0008) Initial Access (TA0001)
ATT&CK Technique	Steal Application Access Token (T1528) Use Alternate Authentication Material: Application Access Token (T1550.001) Unsecured Credentials (T1552) Valid Accounts: Cloud Accounts (T1078.004)
Severity	Low

An AWS service token was used externally of the cloud environment.

Exfiltrate a token and abuse it remotely.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

An AWS service token was used externally of the cloud environment.

Exfiltrate a token and abuse it remotely.