AWS CloudTrail: Successful Deletion of SAML Provider

title: "AWS CloudTrail: Successful Deletion of SAML Provider"
id: 9bead348-83c9-44c2-907e-b1296b1776c5
status: experimental
description: This rule flags successful IAM actions where an AWS SAML provider is deleted. Removing a SAML provider can disrupt authentication paths for administrators and security teams, potentially reducing their ability to access systems or investigate activity during and after an incident. It relies on AWS CloudTrail event data matching eventSource iam.amazonaws.com and eventName DeleteSAMLProvider with a success status.
references:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
  - attack.stealth
  - attack.t1078.004
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.t1531
  - attack.impact
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: DeleteSAMLProvider
    status: success
  condition: selection
falsepositives:
  - Automated processes using tools like Terraform may trigger this alert.
  - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected.
  - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374
    type: derived