T1606.002 — SAML Tokens

Tactic: Credential Access · Platforms: SaaS, Windows, IaaS, Office Suite, Identity Provider

An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate. The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This…

Sub-technique of Forge Web Credentials (T1606).

Sigma detection rules (5)

title: "T1606.002 Forge Web Credentials: SAML Tokens"
id: 859f8af8-fd22-44ed-ba54-bb3dcc707441
description: 'Forging a SAML token is a cryptographic operation performed off-host once the AD FS token-signing certificate/private key (or its AD-stored DKM container copy) has been obtained, and is not directly observable via a single Windows/Sysmon event. This rule instead targets the closest Windows-observable precursor: directory reads of the AD FS Distributed Key Manager (DKM) container objects in Active Directory, which hold the encrypted token-signing key material abused in Golden SAML attacks. (Data Component: DS Object Access.) Tune using: DKMContainerDN, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1606/002
author: Shahrukh Khan
date: 2026-03-25
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4662
    ObjectType: 'container'
    ObjectName|contains: 'CN=ADFS'
    Properties|contains:
      - 'Read Property'

  filter_system_account:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - AD FS servers and health agents themselves routinely reading the DKM container as part of normal token-signing operations; scope SubjectUserName to exclude the AD FS service/computer accounts and focus on unexpected principals.

level: high

title: "T1606.002 Forge Web Credentials: SAML Tokens"
id: d15750b2-f81a-4f62-bcf1-414da28a0a77
description: 'Detection Strategy for Forged SAML Tokens. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CrossAccountUsage.'
references:
  - https://attack.mitre.org/techniques/T1606/002
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'AssumeRoleWithSAML'

  condition: selection

falsepositives:
  - Legitimate cross-account SAML federation from an approved identity provider partner outside the primary account allow list.

level: high

title: "T1606.002 Forge Web Credentials: SAML Tokens"
id: fcb533b3-110e-446f-a68b-e99779d1a3dc
description: 'Detection Strategy for Forged SAML Tokens. (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: GeoVelocityThreshold.'
references:
  - https://attack.mitre.org/techniques/T1606/002
author: Shahrukh Khan
date: 2026-05-11
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.002

logsource:
  product: saas
  service: access

detection:
  selection_replay:
    event_type: 'saml_response_replay_detected'
  selection_forged:
    event_type: 'token_forged_suspected'

  condition: selection_replay or selection_forged

falsepositives:
  - Clock-skew or network-retry conditions causing a legitimate SAML response to be resubmitted; true confidence requires geo-velocity baselining across the assertion consumer and identity provider.

level: critical

title: "T1606.002 Forge Web Credentials: SAML Tokens"
id: a47c5d2b-ffb0-4db0-8aca-0daa3052d002
description: 'Detects directory-service reads of the AD FS configuration/DKM container that stores the token-signing certificate private key material, a precursor to Golden SAML token forgery. (Original rule mixed unrelated Kerberos TGS issuance (4769) with generic AD FS events.) Tune using: TokenLifetimeThreshold, TrustedIssuerList.'
references:
  - https://attack.mitre.org/techniques/T1606/002
author: Shahrukh Khan
date: 2026-03-13
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4662
    ObjectType: 'container'
    ObjectName|contains: 'CN=ADFS,CN=Services'

  filter_system_account:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'ADFS
    
  



  condition: selection and not filter_system_account

falsepositives:
  - The AD FS service account and authorized administrators performing legitimate token-signing certificate rotation/maintenance are excluded via filter_system_account; tune further if noise remains from other authorized processes.

level: high

title: "T1606.002 Forge Web Credentials: SAML Tokens"
id: 9f41f1b0-8e2f-405e-8970-745431038b24
description: 'Detection Strategy for Forged SAML Tokens. (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: ReplayDetectionThreshold.'
references:
  - https://attack.mitre.org/techniques/T1606/002
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.002

logsource:
  product: m365
  service: exchange

detection:
  selection:
    Operation: 'MailItemsAccessed'
  filter_owner:
    ClientIP|cidr: '10.0.0.0/8'
  condition: selection and not filter_owner

falsepositives:
  - Legitimate use of Exchange Web Services by an approved mobile mail client or third-party archiving tool from an external network; direct SAML token replay detection is not observable from mailbox access events alone.

level: medium

Related sub-techniques

• T1606.001 Web Cookies

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1606.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan