{"id":"055fb148-60f8-462d-ad16-26926ce050f1","title":"AWS User Login Profile Was Modified","description":"Detects activity when someone is changing passwords on behalf of other users.\nAn attacker with the \"iam:UpdateLoginProfile\" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.\n","author":"toffeebr33k","status":"test","level":"high","date":"2021-08-09","modified":"2024-04-26","tags":["attack.persistence","attack.privilege-escalation","attack.t1098"],"technique_ids":["T1098"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Legitimate user account administration"],"references":["https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation"],"source_path":"rules/cloud/aws/cloudtrail/aws_update_login_profile.yml","source_sha256":"d29c571268666e01c24c0f3492b7fc04ccb66b165294c79c3b9afac57db80af6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_update_login_profile.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS User Login Profile Was Modified\nid: 055fb148-60f8-462d-ad16-26926ce050f1\nstatus: test\ndescription: |\n    Detects activity when someone is changing passwords on behalf of other users.\n    An attacker with the \"iam:UpdateLoginProfile\" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.\nreferences:\n    - https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation\nauthor: toffeebr33k\ndate: 2021-08-09\nmodified: 2024-04-26\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1098\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: 'iam.amazonaws.com'\n        eventName: 'UpdateLoginProfile'\n    filter_main_user_identity:\n        userIdentity.arn|fieldref: requestParameters.userName\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate user account administration\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","page":"techniques/enterprise/T1098/"}],"data_path":"data/detection-rules/055fb148-60f8-462d-ad16-26926ce050f1.json","kind":"sigma"}