AWS IAM SAML Provider Deletion via CloudTrail

Alerts on successful CloudTrail events where an AWS SAML provider is deleted, signaling potential disruption of admin/security access.

FreeReviewedSigma · Medium · v5

Product: aws
Service: cloudtrail
Author: Ivan Saakov (SigmaHQ), DRL 1.1
Published: 2024-12-19
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Impact

Recon
Resource Dev
Initial Access
- T1078.004Cloud Accounts
Execution
Persistence
- T1078.004Cloud Accounts
Priv Esc
- T1078.004Cloud Accounts
Defense Evasion
- T1078.004Cloud Accounts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1531Account Access Removal

What it detects

This rule identifies successful CloudTrail events where an AWS IAM SAML provider is deleted. Deleting a SAML provider can disrupt authentication for users who rely on that identity provider, affecting administrative and security access. The detection relies on CloudTrail telemetry, matching the IAM eventSource, DeleteSAMLProvider eventName, and a success status.

Reporting behind it

Related detections9 linkedT1078.004 — drag to rearrange

Suspicious Okta SSO Access to Many Applications in Short Window

Suspicious Microsoft Entra Device Code Authentication Flow

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)

Suspicious Azure Cognitive Services Account Key Enumeration via ListKeys (via azure)

Malicious Business Email Compromise OAuth Application Sign-In via Entra ID Service Principal (via azure)

Suspicious AWS API Call from TruffleHog Credential Scanner User Agent

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

AWS IAM SAML Provider Deletion via CloudTrail

Pivot detection · T1078.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-successful-deletion-of-saml-provider-ccd6a6c8

title: AWS IAM SAML Provider Deletion via CloudTrail
id: 9bead348-83c9-44c2-907e-b1296b1776c5
status: experimental
description: This rule identifies successful CloudTrail events where an AWS IAM SAML provider is deleted. Deleting a SAML provider can disrupt authentication for users who rely on that identity provider, affecting administrative and security access. The detection relies on CloudTrail telemetry, matching the IAM eventSource, DeleteSAMLProvider eventName, and a success status.
references:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
  - attack.stealth
  - attack.t1078.004
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.t1531
  - attack.impact
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: DeleteSAMLProvider
    status: success
  condition: selection
falsepositives:
  - Automated processes using tools like Terraform may trigger this alert.
  - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected.
  - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL