Get Caller Identity¶
An adversary may attempt to verify their current identity with the credentials they hold. This could both be to verify that the credentials they hold are valid, and to get more information on their current identity for reconnaissance purposes.
gcloud auth list
When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.
eventName:GetCallerIdentity AND eventSource:*.sts.amazonaws.com