AWS User Login Profile Was Modified — Sigma Rule

Rule metadata and linked tags

Author: toffeebr33k. Source status: test; severity: high. Source dates: 2021-08-09 / 2024-04-26.

{
  "product": "aws",
  "service": "cloudtrail"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: d29c571268666e01c24c0f3492b7fc04ccb66b165294c79c3b9afac57db80af6

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: AWS User Login Profile Was Modified
id: 055fb148-60f8-462d-ad16-26926ce050f1
status: test
description: |
    Detects activity when someone is changing passwords on behalf of other users.
    An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
references:
    - https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation
author: toffeebr33k
date: 2021-08-09
modified: 2024-04-26
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'iam.amazonaws.com'
        eventName: 'UpdateLoginProfile'
    filter_main_user_identity:
        userIdentity.arn|fieldref: requestParameters.userName
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate user account administration
level: high

Original YAML and metadata in JSON

False positives

• Legitimate user account administration

Source references

• https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation