[THREAT-197] AWS Credential Misuse Rules (STS, CloudTrail)

[alessandrarizzo]

Background

Add 4 new detection rules for AWS STS abuse and credential misuse patterns

Changes

- AWS.STS.GetCallerIdentity.TruffleHog — Detects credential validation by TruffleHog scanning tool
- AWS.STS.GetSessionToken.Misuse — Detects IAM users calling GetSessionToken for temporary credential generation
- AWS.Console.GetSigninToken.Abuse — Detects potential abuse of console federation sign-in tokens
- AWS.CloudTrail.IMDSCredentialExfiltration — Detects IMDS credential usage outside expected EC2 services

Testing

[cursor]

PR Summary

Medium Risk
Adds four new experimental CloudTrail detections that may materially change alert volume and require tuning (notably the high-severity IMDS exfiltration rule), but does not modify existing rule logic or core platform code.

Overview
Adds four new experimental AWS CloudTrail detection rules for credential-misuse patterns: suspicious GetSigninToken console federation requests (excluding known SSO user agents), IMDS-derived instance credentials used from public IPs/outside expected internal services, GetCallerIdentity calls with TruffleHog user agents, and GetSessionToken calls initiated by IAM users.

Updates the AWS documentation/indexes (alpha-index.md, aws.md) and detection-coverage.json to include these new rules, along with rule metadata, runbooks, and test fixtures in the corresponding YAMLs.

^{Reviewed by Cursor Bugbot for commit 8487171. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 15b4944. Configure here.}