Remote usage of an AWS service token

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-07-19

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Lateral Movement (TA0008) Initial Access (TA0001)
ATT&CK Technique	Steal Application Access Token (T1528) Use Alternate Authentication Material: Application Access Token (T1550.001) Unsecured Credentials (T1552) Valid Accounts: Cloud Accounts (T1078.004)
Severity	Low

An AWS service token was used externally of the cloud environment.

Exfiltrate a token and abuse it remotely.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

An AWS service token was used externally of the cloud environment.

Exfiltrate a token and abuse it remotely.