
Summary
The AWS UpdateLoginProfile rule is designed to detect suspicious activity within AWS environments pertaining to the update of user login profiles. Specifically, it utilizes AWS CloudTrail logs to monitor events where one user modifies the login profile of another user, which can be indicative of privilege escalation attempts. This event tracking is essential for identifying potential unauthorized access or control over sensitive resources through compromised accounts. The detection process involves filtering for UpdateLoginProfile events, ensuring that only actions taken by different users than those whose profiles are updated are flagged. This functionality is crucial for maintaining the integrity of AWS account permissions and preventing abuse of privileges.
Categories
- Cloud
- AWS
- Identity Management
Data Sources
- Cloud Storage
ATT&CK Techniques
- T1136.003
- T1136
- T1078
Created: 2024-11-14