• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    AWS New SAML/OIDC Identity Provider Added

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Lacey Cochrane@NullVectorX
    •updated Mar 16, 2026•3•0•82

    Detects when a new federation identity provider (SAML or OpenID Connect) is created or updated in AWS Identity and Access Management (IAM). This could indicate an attempt to establish new trust relationships for federated access.

    Cortex XDR

    Tags

    T1136.003 - Create Account: Cloud AccountT1098.001 - Account Manipulation: Additional Cloud CredentialsTA0003 - PersistenceTA0004 - Privilege EscalationCloud Identity FederationAdmin ActivityPolicy ChangeAWSAWS Cloudtrail

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?