Sigma high test sigma

AWS Identity Center Identity Provider Change

Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.

View Source

Detection Logic

{
  "selection": {
    "eventSource": [
      "sso-directory.amazonaws.com",
      "sso.amazonaws.com"
    ],
    "eventName": [
      "AssociateDirectory",
      "DisableExternalIdPConfigurationForDirectory",
      "DisassociateDirectory",
      "EnableExternalIdPConfigurationForDirectory"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ Authorized changes to the AWS account's identity provider

Field Validations

Loading…

Comments (0)

Loading comments...