Suspicious AWS SAML Provider Removal Behavior (via cloudtrail)

title: Suspicious AWS SAML Provider Removal Behavior (via cloudtrail)
id: e29dac44-090c-5dad-b1e7-6730e042c98f
status: stable
description: This rule detects the deletion of an AWS SAML provider, potentially suggesting hostile intent to disrupt administrative or security team access. An adversary can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
references:
    - https://attack.mitre.org/techniques/T1531/
    - https://attack.mitre.org/techniques/T1078/004/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
author: Huntrule Team
date: 2026-05-25
tags:
    - attack.stealth
    - attack.t1078.004
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.t1531
    - attack.impact
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'iam.amazonaws.com'
        eventName: 'DeleteSAMLProvider'
        status: 'success'
    condition: selection
falsepositives:
    - Unknown
level: medium