AWS SAML Update identity provider

Status: production
Severity: medium
Group by: aws::awsRegion, aws::recipientAccountId, aws::userAgent, dest, signature, src, user, vendor_product
Author: Rod Soto, Splunk
Source: github.com/splunk/security_content

The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the UpdateSAMLProvider event, analyzing fields such as sAMLProviderArn, sourceIPAddress, and userIdentity details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.

Known false positives

Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts
Privilege Escalation	`T1078` Valid Accounts
Stealth	`T1078` Valid Accounts

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `UpdateSAMLProvider`: Updates the metadata document for an existing SAML provider in IAM.

Rules detecting the same action

These rules filter on the same operation.

ASL AWS SAML Update identity provider (Splunk)
AWSCloudTrail - SAML update identity provider (Kusto)

Rule body

name: AWS SAML Update identity provider
id: 2f0604c6-6030-11eb-ae93-0242ac130002
version: 12
creation_date: '2021-01-26'
modification_date: '2026-05-13'
author: Rod Soto, Splunk
status: production
type: TTP
description: The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
data_source:
    - AWS CloudTrail UpdateSAMLProvider
search: |-
    `cloudtrail` eventName=UpdateSAMLProvider
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.sAMLProviderArn) as request_parameters
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_saml_update_identity_provider_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
references:
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-008a
    - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
    - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
finding:
    title: User $user$ from IP address $src$ has trigged an event $signature$ to update the SAML provider to $request_parameters$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Cloud Federated Credential Abuse
asset_type: AWS Federated Account
mitre_attack_id:
    - T1078
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

Stages and Predicates

Stage 1: `search`

`cloudtrail` eventName=UpdateSAMLProvider

Stage 2: `rename`

| rename user_name as user

Stage 3: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.sAMLProviderArn) as request_parameters
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product

Stage 4: `search`

| `security_content_ctime(firstTime)`

Stage 5: `search`

| `security_content_ctime(lastTime)`

Stage 6: `search`

| `aws_saml_update_identity_provider_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`UpdateSAMLProvider`	`field:"aws::eventName" kind:eq value:"UpdateSAMLProvider"`
`sourcetype`	eq	`aws:cloudtrail`	`field:"sourcetype" kind:eq value:"aws:cloudtrail"`