AWS SAML Provider Deletion Activity
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "DETECTION_ACTION_AWS_SAML_PROVIDER_DELETED" select Action1.CALLER,Action1.HOSTNAME,Action1.IPADDRESS,Action1.LOG_EVENT_NAME,Action1.SOURCE,Action1.SOURCE_REGION,Action1.REQUESTPARAMETERS
Detection
Execution Mode
realtime
Log Sources
AWS
Author
Ivan Saakov
