{"id":"d3adb3ef-b7e7-4003-9092-1924c797db35","title":"AWS Identity Center Identity Provider Change","description":"Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.\nA change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.\n","author":"Michael McIntyre @wtfender","status":"test","level":"high","date":"2023-09-27","modified":"","tags":["attack.persistence","attack.credential-access","attack.defense-impairment","attack.t1556"],"technique_ids":["T1556"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Authorized changes to the AWS account's identity provider"],"references":["https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html","https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html","https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html"],"source_path":"rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml","source_sha256":"7ea2c37b143dacc7c240f87d69212a325155090b3535baa33ba38e8a7f58f145","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS Identity Center Identity Provider Change\nid: d3adb3ef-b7e7-4003-9092-1924c797db35\nstatus: test\ndescription: |\n    Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.\n    A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.\nreferences:\n    - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html\n    - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html\n    - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html\nauthor: Michael McIntyre @wtfender\ndate: 2023-09-27\ntags:\n    - attack.persistence\n    - attack.credential-access\n    - attack.defense-impairment\n    - attack.t1556\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource:\n            - 'sso-directory.amazonaws.com'\n            - 'sso.amazonaws.com'\n        eventName:\n            - 'AssociateDirectory'\n            - 'DisableExternalIdPConfigurationForDirectory'\n            - 'DisassociateDirectory'\n            - 'EnableExternalIdPConfigurationForDirectory'\n    condition: selection\nfalsepositives:\n    - Authorized changes to the AWS account's identity provider\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1556","id":"T1556","name":"Modify Authentication Process","page":"techniques/enterprise/T1556/"}],"data_path":"data/detection-rules/d3adb3ef-b7e7-4003-9092-1924c797db35.json","kind":"sigma"}