AWS Identity Center Identity Provider Change

 1title: AWS Identity Center Identity Provider Change
 2id: d3adb3ef-b7e7-4003-9092-1924c797db35
 3status: experimental
 4description: |
 5    Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
 6    A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.    
 7references:
 8    - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html
 9    - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html
10    - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html
11author: Michael McIntyre @wtfender
12date: 2023/09/27
13tags:
14    - attack.persistence
15    - attack.t1556
16logsource:
17    product: aws
18    service: cloudtrail
19detection:
20    selection:
21        eventSource:
22            - 'sso-directory.amazonaws.com'
23            - 'sso.amazonaws.com'
24        eventName:
25            - 'AssociateDirectory'
26            - 'DisableExternalIdPConfigurationForDirectory'
27            - 'DisassociateDirectory'
28            - 'EnableExternalIdPConfigurationForDirectory'
29    condition: selection
30falsepositives:
31    - Authorized changes to the AWS account's identity provider
32level: high

References

• AWS IAM Identity Center

  
  Read More

• IAM Identity Center information in CloudTrail - AWS IAM Identity Center

  CloudTrail is enabled on your AWS account when you create the account. When activity occurs in IAM Identity Center, that activity is recorded in a CloudTrail event along with other AWS service events in Event history . You can view, search, and download recent events in your AWS account. For more information, see

  
  Read More

• Actions, resources, and condition keys for AWS IAM Identity Center (successor to AWS Single Sign-On) - Service Authorization Reference

  Lists all of the available service-specific resources, actions, and condition keys that can be used in IAM policies to control access to AWS IAM Identity Center (successor to AWS Single Sign-On).

  
  Read More

Related rules

• Change to Authentication Method
• Disabled MFA to Bypass Authentication Mechanisms
• Disabling Multi Factor Authentication
• AWS ElastiCache Security Group Created
• AWS IAM Backdoor Users Keys