AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates
Flags CloudTrail activity involving SAML provider updates plus SAML role assumptions in AWS, which can enable backdoor access.
- Product
- aws
- Service
- cloudtrail
- Author
- Austin Songer (SigmaHQ), DRL 1.1
- Published
- 2021-09-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Cred Access
Discovery
Collection
C2
Exfiltration
Impact
What it detects
This rule flags CloudTrail activity where an AWS principal performs AssumeRoleWithSAML and where the SAML provider is updated via UpdateSAMLProvider. Such changes can enable an attacker to establish or maintain access through SAML-based authentication paths. It relies on AWS CloudTrail events covering both STS AssumeRoleWithSAML and IAM UpdateSAMLProvider, matching on eventSource and eventName pairs.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS CloudTrail Alert for Suspicious SAML Role Assumption and SAML Provider Updates
id: adbeaab2-7b0e-45d6-8d9e-a550b7b50dde
status: test
description: This rule flags CloudTrail activity where an AWS principal performs AssumeRoleWithSAML and where the SAML provider is updated via UpdateSAMLProvider. Such changes can enable an attacker to establish or maintain access through SAML-based authentication paths. It relies on AWS CloudTrail events covering both STS AssumeRoleWithSAML and IAM UpdateSAMLProvider, matching on eventSource and eventName pairs.
references:
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
- https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml
author: Austin Songer, Huntrule Team
date: 2021-09-22
modified: 2022-12-18
tags:
- attack.initial-access
- attack.lateral-movement
- attack.persistence
- attack.privilege-escalation
- attack.stealth
- attack.t1078
- attack.t1548
- attack.t1550
- attack.t1550.001
logsource:
product: aws
service: cloudtrail
detection:
selection_sts:
eventSource: sts.amazonaws.com
eventName: AssumeRoleWithSAML
selection_iam:
eventSource: iam.amazonaws.com
eventName: UpdateSAMLProvider
condition: 1 of selection_*
falsepositives:
- Automated processes that uses Terraform may lead to false positives.
- SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
- SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
type: derived