AN0526
Analytic 0526
IaaS
Use of AWS STS or GCP IAM APIs to request temporary tokens or federation sessions inconsistent with normal account activity, including from unexpected principals or regions.
AWS:CloudTrail
AssumeRole, GetFederationToken, GetSessionToken
AWS:CloudTrail
sts:GetFederationToken
[GeoIPDistanceThreshold]
Distance between token creation and resource use locations
[RoleScope]
Limit scope of acceptable role assumptions by account type
AN0527
Analytic 0527
Identity Provider
OAuth or SAML access tokens reused across multiple sessions or clients without corresponding MFA or login activity.
azure:signinlogs
TokenIssued, RefreshTokenUsed
m365:unified
Delegated permission grants without user login event
[MFAEnforcement]
Ensure MFA context exists prior to token issuance
[TokenReuseWindow]
Maximum acceptable window for refresh token reuse
AN0528
Analytic 0528
SaaS
Application access tokens used to call APIs (e.g., Google Workspace, Salesforce) without interactive logins, often with unusual scopes or elevated permissions.
saas:googleworkspace
OAuthTokenGranted, APIRequest
saas:salesforce
API login using access_token without login history
[ApplicationScopeAllowlist]
Restrict allowed API scopes for enterprise applications
[TokenLifetime]
Threshold for detecting unusually long-lived tokens
AN0529
Analytic 0529
Office Suite
OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.
m365:unified
OAuthTokenIssued, FileAccessed, MailItemsAccessed
[ClientAppIDWhitelist]
Restrict trusted Office apps authorized to request tokens
AN0530
Analytic 0530
Containers
Compromised service account tokens mounted inside containers and reused for external API calls or lateral movement across services.
kubernetes:apiserver
serviceAccount token used in API requests not tied to workload identity
AWS:CloudTrail
AssumeRoleWithWebIdentity
[NamespaceScope]
Restrict token use to specific namespaces or workloads