Techniques › T1606.002 › AN0421
AN0421 Analytic 0421
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Forged SAML tokens can appear as SaaS logins where authentication succeeded without MFA, or where tokens contain claims inconsistent with the user profile. Look for concurrent sessions across different geographies with the same SAML assertion ID.</p>
- Detects
- T1606.002 SAML Tokens
- Part of
- DET0148 Detection Strategy for Forged SAML Tokens
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:access | SAML token accepted without preceding login challenge | DC0007 Web Credential Usage |
| m365:unified | Abnormal user claims or unexpected elevated role assignment in SAML assertion | DC0088 Logon Session Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
GeoVelocityThreshold | Triggers when same SAML token used in different geographies within short timeframe. |