Techniques › T1556.009 › AN0087
AN0087 Analytic 0087
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects modifications to IAM conditions or policies that alter authentication behavior, such as adding permissive trusted IPs, removing MFA requirements, or changing regional access restrictions. Behavioral detection focuses on anomalous policy updates tied to privileged accounts and subsequent suspicious logon activity from previously blocked regions or devices.</p>
- Detects
- T1556.009 Conditional Access Policies
- Part of
- DET0030 Detect Conditional Access Policy Modification in Identity and Cloud Platforms
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | PutUserPolicy, PutGroupPolicy, PutRolePolicy, CreatePolicyVersion | DC0069 Cloud Service Modification |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MonitoredIAMConditions | Specific condition keys (SourceIp, RequestedRegion, MFAAuthenticated) tuned per environment. |
TimeWindow | Correlates policy modification with follow-on logins from newly permitted sources. |
PrivilegedAccounts | List of administrative accounts to prioritize when monitoring for conditional access changes. |