update metadata

rules/cloud/aws/cloudtrail/aws_delete_saml.yml → rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml

@@ -1,11 +1,13 @@
 title: AWS SAML Provider Deletion Activity
 id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374
 status: experimental
-description: An attacker can remove the SAML provider for the information security team, a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
+description: |
+    Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
+    An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
 references:
     - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
 author: Ivan Saakov
-date: 2024-09-20
+date: 2024-12-19
 tags:
     - attack.t1078.004
     - attack.privilege-escalation