AWS IAM SAML Provider Deletion via CloudTrail

title: AWS IAM SAML Provider Deletion via CloudTrail
id: 9bead348-83c9-44c2-907e-b1296b1776c5
status: experimental
description: This rule identifies successful CloudTrail events where an AWS IAM SAML provider is deleted. Deleting a SAML provider can disrupt authentication for users who rely on that identity provider, affecting administrative and security access. The detection relies on CloudTrail telemetry, matching the IAM eventSource, DeleteSAMLProvider eventName, and a success status.
references:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
  - attack.stealth
  - attack.t1078.004
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.t1531
  - attack.impact
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: DeleteSAMLProvider
    status: success
  condition: selection
falsepositives:
  - Automated processes using tools like Terraform may trigger this alert.
  - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected.
  - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374
    type: derived