AWS SAML Provider Deletion Activity

Ivan Saakov

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

2024-12-19 00:00:00

None

ccd6a6c8-bb4e-4a91-9d2a-07e632819374

attack.t1078.004 attack.privilege-escalation attack.t1531

Community Rule

Ivan S

Merge PR #5015 from @saakovv - Add `AWS SAML Provider Deletion Activity`

2024-12-19