SAML Token Issuer Anomaly Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects an anomaly in the SAML token issuer, indicating a potential compromise of the SAML token. The detection is triggered when the 'riskEventType' is 'tokenIssuerAnomaly', suggesting that the claims within the token are unusual or align with known attacker patterns. This could signify an adversary forging web credentials, specifically SAML tokens, to gain unauthorized access.