An AWS SAML provider was modified

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

5 Days

Required Data

• Requires:
  • AWS Audit Log

Detection Modules

Cloud

Detector Tags

ATT&CK Tactic

• Initial Access (TA0001)
• Defense Evasion (TA0005)

ATT&CK Technique

• Trusted Relationship (T1199)
• Modify Authentication Process (T1556)

Severity

Informational