mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
patel-bhavin
143 lines
5.2 KiB
YAML
143 lines
5.2 KiB
YAML
name: AWS CloudTrail AssumeRoleWithSAML
|
|
id: 1e28f2a6-2db9-405f-b298-18734a293f77
|
|
version: 2
|
|
date: '2025-01-23'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs attempts to assume roles via SAML authentication in AWS, including
|
|
details of identity provider and role mapping.
|
|
mitre_components:
|
|
- User Account Authentication
|
|
- Logon Session Creation
|
|
- User Account Metadata
|
|
- Cloud Service Metadata
|
|
- Instance Modification
|
|
source: aws_cloudtrail
|
|
sourcetype: aws:cloudtrail
|
|
separator: eventName
|
|
separator_value: AssumeRoleWithSAML
|
|
supported_TA:
|
|
- name: Splunk Add-on for AWS
|
|
url: https://splunkbase.splunk.com/app/1876
|
|
version: 7.11.0
|
|
fields:
|
|
- _time
|
|
- action
|
|
- app
|
|
- awsRegion
|
|
- change_type
|
|
- command
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- dvc
|
|
- errorCode
|
|
- eventCategory
|
|
- eventID
|
|
- eventName
|
|
- eventSource
|
|
- eventTime
|
|
- eventType
|
|
- eventVersion
|
|
- eventtype
|
|
- host
|
|
- index
|
|
- linecount
|
|
- managementEvent
|
|
- msg
|
|
- object_category
|
|
- product
|
|
- punct
|
|
- readOnly
|
|
- recipientAccountId
|
|
- region
|
|
- requestID
|
|
- requestParameters.durationSeconds
|
|
- requestParameters.principalArn
|
|
- requestParameters.roleArn
|
|
- requestParameters.roleSessionName
|
|
- requestParameters.sAMLAssertionID
|
|
- resources{}.ARN
|
|
- resources{}.accountId
|
|
- resources{}.type
|
|
- responseElements.assumedRoleUser.arn
|
|
- responseElements.assumedRoleUser.assumedRoleId
|
|
- responseElements.audience
|
|
- responseElements.credentials.accessKeyId
|
|
- responseElements.credentials.expiration
|
|
- responseElements.credentials.sessionToken
|
|
- responseElements.issuer
|
|
- responseElements.nameQualifier
|
|
- responseElements.subject
|
|
- responseElements.subjectType
|
|
- signature
|
|
- source
|
|
- sourceIPAddress
|
|
- sourcetype
|
|
- splunk_server
|
|
- src
|
|
- src_ip
|
|
- src_user
|
|
- src_user_id
|
|
- src_user_type
|
|
- start_time
|
|
- status
|
|
- tag
|
|
- tag::action
|
|
- tag::eventtype
|
|
- temp_access_key
|
|
- timeendpos
|
|
- timestartpos
|
|
- user
|
|
- userAgent
|
|
- userIdentity.identityProvider
|
|
- userIdentity.principalId
|
|
- userIdentity.type
|
|
- userIdentity.userName
|
|
- user_agent
|
|
- user_arn
|
|
- user_id
|
|
- user_name
|
|
- user_role
|
|
- user_type
|
|
- vendor
|
|
- vendor_account
|
|
- vendor_product
|
|
- vendor_region
|
|
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "SAMLUser", "principalId":
|
|
"ZRu9MRAjiG9tvi1QBNfdI664G5A=:rodsoto@rodsoto.onmicrosoft.com", "userName": "rodsoto@rodsoto.onmicrosoft.com",
|
|
"identityProvider": "ZRu9MRAjiG9tvi1QBNfdI664G5A="}, "eventTime": "2021-01-22T03:44:16Z",
|
|
"eventSource": "sts.amazonaws.com", "eventName": "AssumeRoleWithSAML", "awsRegion":
|
|
"us-east-1", "sourceIPAddress": "72.21.217.152", "userAgent": "AWS Signin, aws-internal/3
|
|
aws-sdk-java/1.11.898 Linux/4.9.230-0.1.ac.223.84.332.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01
|
|
java/1.8.0_275 kotlin/1.3.72 vendor/Oracle_Corporation", "requestParameters": {"sAMLAssertionID":
|
|
"_d33ba0ad-0c88-4b83-80a6-27c08027d000", "roleSessionName": "rodsoto@rodsoto.onmicrosoft.com",
|
|
"durationSeconds": 3600, "roleArn": "arn:aws:iam::111111111111:role/rodonmicrotestrole",
|
|
"principalArn": "arn:aws:iam::111111111111:saml-provider/rodsotoonmicrosoft"}, "responseElements":
|
|
{"subjectType": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", "issuer":
|
|
"https://sts.windows.net/0e8108b1-18e9-41a4-961b-dfcddf92ef08/", "credentials":
|
|
{"accessKeyId": "ASIAYTOGP2RLKJXOV7VR", "expiration": "Jan 22, 2021 3:59:16 AM",
|
|
"sessionToken": "IQoJb3JpZ2luX2VjENz//////////wEaCXVzLWVhc3QtMSJGMEQCIHl/WQdLq53ULYl10fPtpeV3H7da9mOXGuIStvhdDA6kAiAdO/7rocOXAtyDV+0MJhSj/piqlqEI/BcAKm8zqBhOgiqgAwi1//////////8BEAIaDDU5MTUxMTE0NzYwNiIMAFP8GfyI/x1fKCHYKvQCznxxgKnEdcuvrr/fBLmHxEDjQ9vQxjasA8gZF8GawZ5SFH9ViKqoZh93bYkOwKqZD8cdqJIo9SYL17RGhVqxzvsjU4+QsRXTN5eGgh+LyF9EZqeCl6oCkaTJqNrXHuenzTi0yiL510LKsSckrAm8+SuwI/jQu3oE1BEcJQieAc4RjYx3II+1cUvyfRlFvR2NDfZhdWcQvAivV06KJg9c2zfCF0Agzn/YZSNvsRL5UhnKhJ2wktSvT8lR0mS3n9xR1j3iYNxVDHab180cnfkP3G6tAmxj5U29diNQrusJxKWWhr/Q9wHRdDj5dO2QUZzSymKKU/UiRJ8nyYPINaJ8XWVAPiT4QgzpMxotkvSkDLEG/brB9yEr2p7W8Y3xMGZ37qSGkuU4z9x40RU9G1XPhv27NO9aaGs/VXYTMCzWRNxnsLfNkk/DihrcaR0SclRcvs+zmfe1ZUoGnfjNYm+AIyJi4D7OrXF5/Mt46Z2y76DnULlAMJCUqYAGOpsBw4fyafV8OizX7Lebh2JRXFZsWBY1GTpyGvO5otrw++4axud44vYVi5iU5rbJxtTBm4vtJartxgXoPJFnQuat9gLrIlXhjmg+m50a5xs1Ut2UWEsWY2Duu4jA9ap7P7dYv9kIK9P2uyhsjKQhCjTpfe4I/llcupbDotYBJuvlB5n85a5kgiSriFk5zetoXQIweuYEWQZsD/AN+LE="},
|
|
"nameQualifier": "ZRu9MRAjiG9tvi1QBNfdI664G5A=", "assumedRoleUser": {"assumedRoleId":
|
|
"AROAYTOGP2RLKFUVAQAIJ:rodsoto@rodsoto.onmicrosoft.com", "arn": "arn:aws:sts::111111111111:assumed-role/rodonmicrotestrole/rodsoto@rodsoto.onmicrosoft.com"},
|
|
"subject": "rodsoto@rodsoto.onmicrosoft.com", "audience": "https://signin.aws.amazon.com/saml"},
|
|
"requestID": "e19c7a7f-cd96-4642-9ee6-2360a7b01b12", "eventID": "b25b825d-9c9b-49d3-9ecd-290dbe8f2c29",
|
|
"readOnly": true, "resources": [{"accountId": "111111111111", "type": "AWS::IAM::Role",
|
|
"ARN": "arn:aws:iam::111111111111:role/rodonmicrotestrole"}, {"accountId": "111111111111",
|
|
"type": "AWS::IAM::SAMLProvider", "ARN": "arn:aws:iam::111111111111:saml-provider/rodsotoonmicrosoft"}],
|
|
"eventType": "AwsApiCall", "managementEvent": true, "eventCategory": "Management",
|
|
"recipientAccountId": "111111111111"}'
|
|
output_fields:
|
|
- dest
|
|
- user
|
|
- user_agent
|
|
- src
|
|
- vendor_account
|
|
- vendor_region
|
|
- vendor_product
|