AWS Suspicious SAML Behavior (via cloudtrail)

title: AWS Suspicious SAML Behavior (via cloudtrail)
id: 2eab6ad7-a119-5871-bc63-09ecf0d7cd5e
status: stable
description: This rule detects when anomalous SAML behavior has occurred in AWS. An adversary could gain backdoor access via SAML.
references:
    - https://attack.mitre.org/techniques/T1550/001/
    - https://attack.mitre.org/techniques/T1550/
    - https://attack.mitre.org/techniques/T1548/
    - https://attack.mitre.org/techniques/T1078/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
    - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
author: Huntrule Team
date: 2026-02-07
tags:
    - attack.initial-access
    - attack.lateral-movement
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1078
    - attack.t1548
    - attack.t1550
    - attack.t1550.001
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_sts:
        eventSource: 'sts.amazonaws.com'
        eventName: 'AssumeRoleWithSAML'
    selection_iam:
        eventSource: 'iam.amazonaws.com'
        eventName: 'UpdateSAMLProvider'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium