Sigma rule: AWS SAML Provider Deletion Activity

Rule

Title

AWS SAML Provider Deletion Activity

Status

experimental

Level

medium

Author

Ivan Saakov

Date

2024-12-19

File

rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventSource: 'iam.amazonaws.com'
    eventName: 'DeleteSAMLProvider'
    status: 'success'
condition: selection

False positives (as the rule lists them)

• Automated processes using tools like Terraform may trigger this alert.
• Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected.
• Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule.

Tags

• attack.stealth
• attack.t1078.004
• attack.privilege-escalation
• attack.initial-access
• attack.persistence
• attack.t1531
• attack.impact

MITRE ATT&CK ids this rule names

• T1078.004
• T1531

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml