AWS Suspicious SAML Activity — Detection Rule

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Read the full analysis on IntelFusions