Sagan informational stable other

[AWS-STS] Security Token Service event detected (AssumeRoleWithSAML)

[AWS-STS] Security Token Service event detected (AssumeRoleWithSAML)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-STS] Security Token Service event detected (AssumeRoleWithSAML) "; program:sts.amazonaws.com; content:"eventName
| 22 3a 20 22
| AssumeRoleWithSAML"; content: ! "AWSReservedSSO_"; content: ! "AWSServiceRole"; classtype:system-event; reference:url,docs.aws.amazon.com/STS/latest/APIReference/welcome.html; sid:5011430; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...