AWS SAML Provider Deletion Activity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•33

Detects the deletion of an AWS SAML provider, which could indicate an attacker attempting to disrupt administrative or security team access. By removing the SAML provider, an adversary can hinder the ability of security personnel or system administrators to investigate and respond during an attack.