AWS IAM SAML Provider Deletion via CloudTrail
Alerts on successful CloudTrail events where an AWS SAML provider is deleted, signaling potential disruption of admin/security access.
- Product
- aws
- Service
- cloudtrail
- Author
- Ivan Saakov (SigmaHQ), DRL 1.1
- Published
- 2024-12-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies successful CloudTrail events where an AWS IAM SAML provider is deleted. Deleting a SAML provider can disrupt authentication for users who rely on that identity provider, affecting administrative and security access. The detection relies on CloudTrail telemetry, matching the IAM eventSource, DeleteSAMLProvider eventName, and a success status.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS IAM SAML Provider Deletion via CloudTrail
id: 9bead348-83c9-44c2-907e-b1296b1776c5
status: experimental
description: This rule identifies successful CloudTrail events where an AWS IAM SAML provider is deleted. Deleting a SAML provider can disrupt authentication for users who rely on that identity provider, affecting administrative and security access. The detection relies on CloudTrail telemetry, matching the IAM eventSource, DeleteSAMLProvider eventName, and a success status.
references:
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
- attack.stealth
- attack.t1078.004
- attack.privilege-escalation
- attack.initial-access
- attack.persistence
- attack.t1531
- attack.impact
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: iam.amazonaws.com
eventName: DeleteSAMLProvider
status: success
condition: selection
falsepositives:
- Automated processes using tools like Terraform may trigger this alert.
- Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected.
- Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374
type: derived