Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,731
Ready to search
Backends
17
Loaded from pysigma-node
pySigma Versions
10
Newest: 1.3.3
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
AWS User Login Profile Was Modified
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
Conversion Output
AWS User Login Profile Was Modified
Using Splunk · Default · pySigma 1.3.3
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion1.3.3
title: AWS User Login Profile Was Modified
id: 055fb148-60f8-462d-ad16-26926ce050f1
status: test
description: |
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
references:
- https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation
author: toffeebr33k
date: 2021-08-09
modified: 2024-04-26
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1098
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'UpdateLoginProfile'
filter_main_user_identity:
userIdentity.arn|fieldref: requestParameters.userName
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate user account administration
level: high
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/cloud/aws/cloudtrail/aws_update_login_profile.yml