AWS CloudTrail Detects AWS Identity Center Identity Provider Changes

Detects CloudTrail identity center events that associate or change the external identity provider configuration.

FreeUnreviewedSigmahighv1

aws-cloudtrail-detects-aws-identity-center-identity-provider-changes-d3adb3ef

title: AWS CloudTrail Detects AWS Identity Center Identity Provider Changes
id: 9804be12-a38d-42ec-82ab-1c8ccdf81dc3
status: test
description: This rule flags CloudTrail events related to changing the AWS Identity Center (formerly AWS SSO) external identity provider configuration. Such changes can enable persistent access or support privilege escalation by altering how identities are linked and authorized. It relies on CloudTrail telemetry for identity center directory association and external IdP enablement/disablement/disassociation events.
references:
  - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html
  - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html
  - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml
author: Michael McIntyre @wtfender, Huntrule Team
date: 2023-09-27
tags:
  - attack.persistence
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1556
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource:
      - sso-directory.amazonaws.com
      - sso.amazonaws.com
    eventName:
      - AssociateDirectory
      - DisableExternalIdPConfigurationForDirectory
      - DisassociateDirectory
      - EnableExternalIdPConfigurationForDirectory
  condition: selection
falsepositives:
  - Authorized changes to the AWS account's identity provider
level: high
license: DRL-1.1
related:
  - id: d3adb3ef-b7e7-4003-9092-1924c797db35
    type: derived

What it detects

This rule flags CloudTrail events related to changing the AWS Identity Center (formerly AWS SSO) external identity provider configuration. Such changes can enable persistent access or support privilege escalation by altering how identities are linked and authorized. It relies on CloudTrail telemetry for identity center directory association and external IdP enablement/disablement/disassociation events.

Known false positives

Authorized changes to the AWS account's identity provider

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.