AWS Suspicious SAML Activity (f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e)

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
AWS Suspicious SAML Activity (f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e)	Sigma-Rules	Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814)	Attack Pattern	1
AWS Suspicious SAML Activity (f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e)	Sigma-Rules	Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	1
AWS Suspicious SAML Activity (f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e)	Sigma-Rules	Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b)	Attack Pattern	1
AWS Suspicious SAML Activity (f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e)	Sigma-Rules	Application Access Token - T1550.001 (f005e783-57d4-4837-88ad-dbe7faee1c51)	Attack Pattern	1
Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814)	Attack Pattern	Application Access Token - T1550.001 (f005e783-57d4-4837-88ad-dbe7faee1c51)	Attack Pattern	2