diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
new file mode 100644
index 0000000000..d9d9125dd7
--- /dev/null
+++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
@@ -0,0 +1,39 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS.
+ This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially
+ in federated environments using SAML protocol inside the perimeter or cloud provider.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+id: bbe23980-6019-11eb-ae93-0242ac130002
+known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as
+  accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress
+  user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches
+  can provide the necessary context to detect these attacks.
+name: AWS SAML access by provider user and principal
+references:
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+search: sourcetype="aws:cloudtrail" Assumerolewithsaml | spath "requestParameters.principalArn" | search "requestParameters.principalArn"=*
+   | spath "requestParameters.roleArn" | search "requestParameters.roleArn"=* | spath "requestParameters.roleSessionName"
+   | search "requestParameters.roleSessionName"=* | spath recipientAccountId | search recipientAccountId=*
+   | spath "responseElements.assumedRoleUser.arn" | search "responseElements.assumedRoleUser.arn"=*
+   | spath "responseElements.assumedRoleUser.assumedRoleId" | search "responseElements.assumedRoleUser.assumedRoleId"=*
+   | spath "responseElements.issuer" | search "responseElements.issuer"=* | spath sourceIPAddress | search sourceIPAddress=*
+   | spath userAgent | search userAgent=*
+   | table requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId recipientAccountId responseElements.issuer sourceIPAddress userAgent
+   |`aws_saml_access_by_provider_user_and_principal_filter`'
+tags:
+  analytics_story:
+  - Cloud Federated Credential Abuse
+  asset_type: AWS Federated Account
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  automated_detection_testing: n/a
+  dataset:
+  - TBU
+type: ESCU
+version: 1