Detection rules › Panther
Panther SAML configuration has been modified
An Admin has modified Panther's SAML configuration.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562 Impair Defenses |
Rule body yaml
AnalysisType: rule
Filename: panther_saml_modified.py
RuleID: "Panther.SAML.Modified"
DisplayName: "Panther SAML configuration has been modified"
Enabled: true
LogTypes:
- Panther.Audit
Severity: High
Tags:
- DataModel
- Defense Evasion:Impair Defenses
Reports:
MITRE ATT&CK:
- TA0005:T1562
Description: An Admin has modified Panther's SAML configuration.
Runbook: Ensure this change was approved and appropriate.
Reference: https://docs.panther.com/system-configuration/saml
SummaryAttributes:
- p_any_ip_addresses
- p_any_usernames
Tests:
- Name: SAML config modified
ExpectedResult: True
Log:
{
"actionName": "UPDATE_SAML_SETTINGS",
"actionParams": {},
"actionResult": "SUCCEEDED",
"actor":
{
"attributes":
{
"email": "homer@springfield.gov",
"emailVerified": true,
"roleId": "111111",
},
"id": "111111",
"name": "Homer Simpson",
"type": "USER",
},
"errors": null,
"p_log_type": "Panther.Audit",
}
- Name: SAML config viewed
ExpectedResult: false
Log:
{
"actionName": "GET_SAML_SETTINGS",
"actionParams": {},
"actionResult": "SUCCEEDED",
"actor":
{
"attributes":
{
"email": "homer@springfield.gov",
"emailVerified": true,
"roleId": "111111",
},
"id": "111111",
"name": "Homer Simpson",
"type": "USER",
},
"errors": null,
"p_log_type": "Panther.Audit",
}
Detection logic
Condition
actionName eq "UPDATE_SAML_SETTINGS"
actionResult eq "SUCCEEDED"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
actionName | eq |
|
actionResult | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
user | actor_user |
ip | source_ip |