Skip to content

Add T1556.009 Conditional Access Policies atomic tests - #3378

Open
einlamye wants to merge 6 commits into
redcanaryco:masterfrom
einlamye:atomic-t1556-conditional-access
Open

einlamye wants to merge 6 commits into
redcanaryco:masterfrom
einlamye:atomic-t1556-conditional-access

Conversation

@einlamye

@einlamye einlamye commented Jul 3, 2026

Copy link
Copy Markdown

Details:
Adds two atomic tests for T1556.009 (Conditional Access Policies):

  1. Disable an Entra ID Conditional Access Policy via Microsoft Graph (Azure AD) —
    Update-MgIdentityConditionalAccessPolicy ... -State disabled; Microsoft.Graph.Identity.SignIns
    dependency; cleanup re-enables.
  2. Remove Source-IP Condition from an AWS IAM Policy (AWS, manual) — publishes a new default IAM
    policy version without the aws:SourceIp condition; cleanup restores the original version.

Testing: pydantic-model validated; mustache-key consistency checked.

Associated Issues: (none)

@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

@github-actions github-actions Bot added the Stale label Oct 5, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants