Techniques › T1606.002 › AN0418
AN0418 Analytic 0418
Identity Provider · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Forged SAML tokens can be observed as authentication attempts with valid signatures but missing expected preceding Kerberos or authentication events. Defenders may correlate SAML assertions with absent Event IDs 4769, 1200, or 1202, or tokens issued with abnormal lifetimes, issuers, or claims compared to baseline.</p>
- Detects
- T1606.002 SAML Tokens
- Part of
- DET0148 Detection Strategy for Forged SAML Tokens
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| azure:signinlogs | SAML-based login with anomalous issuer or NotOnOrAfter lifetime | DC0088 Logon Session Metadata |
| WinEventLog:Security | EventCode=4769, 1200, 1202 | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TokenLifetimeThreshold | Defines the maximum expected lifetime of a SAML token (e.g., >1 hour considered anomalous). |
TrustedIssuerList | List of approved SAML issuers and certificate thumbprints. |