Forge Web Credentials: SAML Tokens T1606.002

Tactic: Credential Access

An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate. The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy. Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (11 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
data_stream.dataset2eq 2fortinet_fortigate.log, o365.audit
event.category2eq 2authentication
Esql.logon_count1eq 11
Esql.recent1le 16
EventType1eq 1login
Provider_Name1eq 1azureactivedirectory
event.outcome1eq 1success
fortinet.firewall.method1eq 1sso
fortinet.firewall.ui1starts_with 1sso
o365.audit.ErrorNumber1in 120001, 20012, 20033
src_ip1is_not_null 1

Top indicator values (36 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.categoryeq
authentication
234
Esql.logon_counteq
1
12
Esql.recentle
6
16
EventTypeeq
login
18
Provider_Nameeq
azureactivedirectory
13
data_stream.dataseteq
fortinet_fortigate.log
18
data_stream.dataseteq
o365.audit
147
event.outcomeeq
success
1375
fortinet.firewall.methodeq
sso
1
fortinet.firewall.uistarts_with
sso
1
o365.audit.ErrorNumberin
20001
1
o365.audit.ErrorNumberin
20012
1
o365.audit.ErrorNumberin
20033
1
o365.audit.ErrorNumberin
399284
1
o365.audit.ErrorNumberin
40008
1
o365.audit.ErrorNumberin
40009
1
o365.audit.ErrorNumberin
40015
1
o365.audit.ErrorNumberin
50006
1
o365.audit.ErrorNumberin
50008
1
o365.audit.ErrorNumberin
5000819
1
o365.audit.ErrorNumberin
50012
1
o365.audit.ErrorNumberin
50013
1
o365.audit.ErrorNumberin
500212
1
o365.audit.ErrorNumberin
500213
1
o365.audit.ErrorNumberin
50027
1
o365.audit.ErrorNumberin
50048
1
o365.audit.ErrorNumberin
50099
1
o365.audit.ErrorNumberin
50132
1
o365.audit.ErrorNumberin
700005
1
o365.audit.ErrorNumberin
75005
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Elastic 2 rules