SAML Tokens
Subtechnique · ATTACK:enterprise:T1606.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1606.002",
"title": "SAML Tokens",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1606/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--1f9c2bae-b441-4f66-a8af-b65946ee72f2",
"external_id": "T1606.002",
"domain": "enterprise",
"created": "2020-12-17T15:24:12.240Z",
"modified": "2025-10-24T17:48:30.302Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "Microsoft SolarWinds Steps",
"url": "https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/"
},
{
"source_name": "Microsoft SAML Token Lifetimes",
"url": "https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes"
},
{
"source_name": "Microsoft SolarWinds Customer Guidance",
"url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
},
{
"source_name": "Cyberark Golden SAML",
"url": "https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps"
},
{
"source_name": "Sygnia Golden SAML",
"url": "https://www.sygnia.co/threat-reports-and-advisories/golden-saml-attack/"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00e7784e-d0c8-48d8-a377-7ec83cf6a474
Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks · Secureworks IRON RITUAL ProfileATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3278a7a8-bf61-45bc-9553-872f222f699d
Mandiant Defend UNC2452 White PaperATTACK:enterprise:T1606.002 → subtechnique-of → ATTACK:enterprise:T1606
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--847b5ffb-77a2-4892-9e96-2b454a2c3f22
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a716922-181e-409c-b112-851e7f172d7c
FireEye ADFSATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cf6e55f-3014-4292-a393-9418c6e6b4a1
Microsoft SolarWinds Customer GuidanceATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a371d1a1-29aa-4d11-bad4-d11866171c6c
AADInternals DocumentationATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1606.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b51d04ec-51da-4017-b806-210429592565
FireEye ADFS