Use of AWS STS or GCP IAM APIs to request temporary tokens or federation sessions inconsistent with normal account activity, including from unexpected principals or regions.
| Data Component | Name | Channel |
|---|---|---|
| Web Credential Usage (DC0007) | AWS:CloudTrail | AssumeRole, GetFederationToken, GetSessionToken |
| User Account Authentication (DC0002) | AWS:CloudTrail | sts:GetFederationToken |
| Field | Description |
|---|---|
| GeoIPDistanceThreshold | Distance between token creation and resource use locations |
| RoleScope | Limit scope of acceptable role assumptions by account type |
OAuth or SAML access tokens reused across multiple sessions or clients without corresponding MFA or login activity.
| Data Component | Name | Channel |
|---|---|---|
| Web Credential Usage (DC0007) | azure:signinlogs | TokenIssued, RefreshTokenUsed |
| User Account Authentication (DC0002) | m365:unified | Delegated permission grants without user login event |
| Field | Description |
|---|---|
| MFAEnforcement | Ensure MFA context exists prior to token issuance |
| TokenReuseWindow | Maximum acceptable window for refresh token reuse |
Application access tokens used to call APIs (e.g., Google Workspace, Salesforce) without interactive logins, often with unusual scopes or elevated permissions.
| Data Component | Name | Channel |
|---|---|---|
| Web Credential Usage (DC0007) | saas:googleworkspace | OAuthTokenGranted, APIRequest |
| User Account Authentication (DC0002) | saas:salesforce | API login using access_token without login history |
| Field | Description |
|---|---|
| ApplicationScopeAllowlist | Restrict allowed API scopes for enterprise applications |
| TokenLifetime | Threshold for detecting unusually long-lived tokens |
OAuth token usage for Exchange Online or SharePoint API access without preceding login or from unauthorized clients.
| Data Component | Name | Channel |
|---|---|---|
| Web Credential Usage (DC0007) | m365:unified | OAuthTokenIssued, FileAccessed, MailItemsAccessed |
| Field | Description |
|---|---|
| ClientAppIDWhitelist | Restrict trusted Office apps authorized to request tokens |
Compromised service account tokens mounted inside containers and reused for external API calls or lateral movement across services.
| Data Component | Name | Channel |
|---|---|---|
| Web Credential Usage (DC0007) | kubernetes:apiserver | serviceAccount token used in API requests not tied to workload identity |
| User Account Authentication (DC0002) | AWS:CloudTrail | AssumeRoleWithWebIdentity |
| Field | Description |
|---|---|
| NamespaceScope | Restrict token use to specific namespaces or workloads |