Title:
AWS Suspicious SAML Activity
Status:
test
Description:Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
References:
-https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
-https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
Author: Austin Songer
Date: 2021-09-22
modified:2022-12-18
Tags:
- -'attack.initial-access'
- -'attack.lateral-movement'
- -'attack.persistence'
- -'attack.privilege-escalation'
- -'attack.stealth'
- -'attack.t1078'
- -'attack.t1548'
- -'attack.t1550'
- -'attack.t1550.001'
Logsource:
- product: aws
- service: cloudtrail
Detection:
selection_sts:
eventSource:
'sts.amazonaws.com'
eventName:
'AssumeRoleWithSAML'
selection_iam:
eventSource:
'iam.amazonaws.com'
eventName:
'UpdateSAMLProvider'
condition:
1 of selection_*
Falsepositives:
-Automated processes that uses Terraform may lead to false positives.
-SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
-SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
Level:
medium
