AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates

Flags CloudTrail activity involving SAML provider updates plus SAML role assumptions in AWS, which can enable backdoor access.

FreeReviewedSigma · Medium · v5

Product: aws
Service: cloudtrail
Author: Austin Songer (SigmaHQ), DRL 1.1
Published: 2021-09-22
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Lateral Movement

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
Priv Esc
- T1078Valid Accounts
- T1548Abuse Elevation Control Mechanism
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1550Use Alternate Authentication Material
- T1550.001Application Access Token
Collection
C2
Exfiltration
Impact

What it detects

This rule flags CloudTrail activity where an AWS principal performs AssumeRoleWithSAML and where the SAML provider is updated via UpdateSAMLProvider. Such changes can enable an attacker to establish or maintain access through SAML-based authentication paths. It relies on AWS CloudTrail events covering both STS AssumeRoleWithSAML and IAM UpdateSAMLProvider, matching on eventSource and eventName pairs.

Reporting behind it

Related detections9 linkedT1550.001 — drag to rearrange

AWS CloudTrail: Suspicious STS AssumeRole sessions from Role-issued principals

AWS CloudTrail: IAMUser STS GetSessionToken Use

Suspicious AWS GetFederationToken Console Access by JavaGhost (via cloudtrail)

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious SSH Daemon Configuration Change Enabling Root Login

Suspicious Federated Identity Credential On-Behalf-Of Token Flow via Sign-In Logs

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

Suspicious Salesforce Bulk API Export via aiohttp User Agent

Suspicious dMSA Object Access with Migration AccessMask

AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates

Pivot detection · T1550.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-suspicious-saml-provider-updates-and-assumerolewithsaml-f43f5d2f

title: AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates
id: adbeaab2-7b0e-45d6-8d9e-a550b7b50dde
status: test
description: This rule flags CloudTrail activity where an AWS principal performs AssumeRoleWithSAML and where the SAML provider is updated via UpdateSAMLProvider. Such changes can enable an attacker to establish or maintain access through SAML-based authentication paths. It relies on AWS CloudTrail events covering both STS AssumeRoleWithSAML and IAM UpdateSAMLProvider, matching on eventSource and eventName pairs.
references:
  - https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
  - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml
author: Austin Songer, Huntrule Team
date: 2021-09-22
modified: 2022-12-18
tags:
  - attack.initial-access
  - attack.lateral-movement
  - attack.persistence
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078
  - attack.t1548
  - attack.t1550
  - attack.t1550.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_sts:
    eventSource: sts.amazonaws.com
    eventName: AssumeRoleWithSAML
  selection_iam:
    eventSource: iam.amazonaws.com
    eventName: UpdateSAMLProvider
  condition: 1 of selection_*
falsepositives:
  - Automated processes that uses Terraform may lead to false positives.
  - SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL