Detection rules › Sigma
AWS Suspicious SAML Activity
Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
| Persistence | T1078 Valid Accounts |
| Privilege Escalation | T1078 Valid Accounts, T1548 Abuse Elevation Control Mechanism |
| Stealth | T1078 Valid Accounts |
| Lateral Movement | T1550.001 Use Alternate Authentication Material: Application Access Token |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
- AWS IAM SAML Provider Updated (Elastic)
- AWS SAML Activity (Panther)
- AWS STS AssumeRole with New MFA Device (Elastic)
Rule body yaml
title: AWS Suspicious SAML Activity
id: f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
status: test
description: Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.
references:
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
- https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
author: Austin Songer
date: 2021-09-22
modified: 2022-12-18
tags:
- attack.initial-access
- attack.lateral-movement
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1078
- attack.t1548
- attack.t1550
- attack.t1550.001
logsource:
product: aws
service: cloudtrail
detection:
selection_sts:
eventSource: 'sts.amazonaws.com'
eventName: 'AssumeRoleWithSAML'
selection_iam:
eventSource: 'iam.amazonaws.com'
eventName: 'UpdateSAMLProvider'
condition: 1 of selection_*
falsepositives:
- Automated processes that uses Terraform may lead to false positives.
- SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_sts
selection_sts:
eventSource: 'sts.amazonaws.com'
eventName: 'AssumeRoleWithSAML'
Stage 2: selection_iam
selection_iam:
eventSource: 'iam.amazonaws.com'
eventName: 'UpdateSAMLProvider'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
eventSource | eq |
|