Forged SAML Token Used for Identity Federation Bypass

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects the use of a forged SAML token for identity federation bypass. It specifically looks for HTTP POST requests (flow:to_server,established; http.client_body;) containing the string "SAMLResponse" (content:"SAMLResponse"; nocase;) and a long base64-encoded string (pcre:"/[A-Za-z0-9+\/]{500,}={0,2}/";) within the client body. The presence of a large base64 string in conjunction with "SAMLResponse" suggests a potentially malicious SAML assertion being submitted.