Techniques › T1606.002 › AN0420
AN0420 Analytic 0420
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Forged SAML tokens may be used on Windows systems to authenticate to federated apps without normal Kerberos activity. Defenders may detect anomalous event correlation, where access to SaaS/O365 via SAML occurs without prior TGT requests or user logons.</p>
- Detects
- T1606.002 SAML Tokens
- Part of
- DET0148 Detection Strategy for Forged SAML Tokens
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:ADFS | Token issuance events showing anomalous claims or issuers | DC0006 Web Credential Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ClaimAnomalyThreshold | Number of unusual claims in a SAML token (e.g., excessive privileges). |