Invalid SAML Detected

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires all of the following: AzureAD Okta
Detection Modules	Identity Threat Module, SaaS Threat Detection
Detector Tags	Active Directory Federation Services Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Forge Web Credentials: SAML Tokens (T1606.002)
Severity	Informational

Description

A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.

Attacker's Goals

An attacker might forge a valid SAML token to impersonate other user accounts. This is used to gain persistent, unauthorized access to cloud resources, and bypassing MFA.

Investigative actions

• Check for recent changes to the SAML signing certificate on both the Identity Provider and the Service Provider to rule out a configuration drift or expiration issue.
• Check for other correlated alerts on on-premises systems that may be related to the Golden SAML attack.
• Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).

Variations

Suspicious Invalid SAML Detected

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Forge Web Credentials: SAML Tokens (T1606.002)
Severity	Low

Description

A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack.

Attacker's Goals

An attacker might forge a valid SAML token to impersonate other user accounts. This is used to gain persistent, unauthorized access to cloud resources, and bypassing MFA.

Investigative actions

• Check for recent changes to the SAML signing certificate on both the Identity Provider and the Service Provider to rule out a configuration drift or expiration issue.
• Check for other correlated alerts on on-premises systems that may be related to the Golden SAML attack.
• Look for signs that the user account is compromised (e.g. abnormal logins, unusual activity).