From 596d1b6e4ce24c0d2f3c6def38f5d02b5c2bfb2e Mon Sep 17 00:00:00 2001 From: toffeebr33k <51730572+toffeebr33k@users.noreply.github.com> Date: Sat, 21 Nov 2020 23:29:49 +0800 Subject: [PATCH] Update aws_update_login_profile.yml --- rules/cloud/aws_update_login_profile.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rules/cloud/aws_update_login_profile.yml b/rules/cloud/aws_update_login_profile.yml index 70bdbf8f7..b4f1b549e 100644 --- a/rules/cloud/aws_update_login_profile.yml +++ b/rules/cloud/aws_update_login_profile.yml @@ -1,4 +1,4 @@ -title: AWS updating an existing login profile +title: Updating the Login Profile of other users on AWS id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: experimental description: An attacker with the iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. With this alert, it is used to detect anyone is changing password on behalf of other users.