This note documents detection patterns related to Golden SAML within Active Directory and federation environments.

Direct Indicators

Log	Event ID	Meaning	Forensic Value	Notes
ADFS Logs	1200	Token issued	Critical	SAML token issued by ADFS to application.
ADFS Logs	1202	Token validation	High	Service provider validating SAML token.
Security	4624	Successful logon	High	Authentication via federated identity.
Security	4769	Kerberos service ticket request	Medium	May appear if attacker pivots back to AD resources.
Azure AD Logs	Sign-in events	Critical	Authentication via federated identity provider.
Sysmon	1	Process creation	Medium	Execution of tools interacting with ADFS configuration.

Indirect Indicators

Indicator	What To Look For	Forensic Value	Notes
Unexpected SAML authentication	SAML tokens issued for unusual users	Critical	Golden SAML allows forging tokens for any user.
Authentication without ADFS login	Access without corresponding ADFS authentication event	Critical	Token forged offline.
Use of privileged accounts via federation	Admin accounts authenticating through ADFS	High	May indicate forged token usage.
Token issuance outside normal patterns	SAML tokens issued at unusual times or frequency	High	Potential abuse of federation trust.
ADFS certificate compromise indicators	Token-signing certificate accessed or exported	Critical	Key requirement for Golden SAML attack.

Common Tools

Tool	Usage
ADFSDump	Extracts ADFS configuration and token signing certificates.
ADFSpoof	Generates forged SAML tokens.
Mimikatz	Extracts ADFS signing certificates from memory or disk.
PowerShell ADFS modules	Enumerates federation configuration.
Custom SAML forging scripts	Create forged tokens for authentication bypass.

Relevant Artifacts

ADFS event logs
Azure AD sign-in logs
Security logs (4624)
ADFS configuration database
Token-signing certificate files
Sysmon logs (process creation)
EDR telemetry detecting certificate access
Network logs for federation authentication

MITRE ATT&CK References

T1606 Forge Web Credentials
T1606.002 SAML Tokens
T1552 Unsecured Credentials

Decision Tree

Is the suspicious event present?
- Identify authentication events using SAML tokens.
What host generated the authentication?
- Determine source IP and system performing access.
Is the account expected to authenticate through federation?
- Investigate normal authentication patterns.
Pivot:
- Federation logs → analyze token issuance events.
- Certificate access → investigate token signing certificate exposure.
- Cloud logs → review Azure AD sign-in activity.
Confirm exploitation
- Determine whether forged SAML tokens were used for authentication.

Example Detection Templates

KQL

SigninLogs
| where AuthenticationDetails contains "Federated"

SecurityEvent
| where EventID == 4624
| summarize count() by Account, IpAddress, bin(TimeGenerated,5m)

EQL

authentication where authentication.type == "federated"

Sigma

title: Suspicious Federated Authentication
id: golden-saml-detection
status: experimental
description: Detects unusual federated authentication activity
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    AuthenticationRequirement: federated
  condition: selection
fields:
  - UserPrincipalName
  - IPAddress
falsepositives:
  - Legitimate federated authentication
level: high
tags:
  - attack.persistence
  - attack.credential_access

Mitigation & Hardening

Control Area	Mitigation	Effectiveness	Notes
Certificate protection	Secure ADFS token signing certificates	Critical	Prevents token forgery.
Monitoring	Alert on unusual federated authentication	High	Detects potential abuse.
Key rotation	Regularly rotate token signing certificates	High	Limits persistence window.
Least privilege	Restrict access to ADFS servers	High	Reduces risk of certificate compromise.
Threat hunting	Review authentication patterns across cloud services	Medium	Detects abnormal activity.