Golden SAML Attack Token Submitted to Service

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects the submission of a Golden SAML attack token to a service. It specifically looks for HTTP POST requests where the URI contains 'saml', the client body contains 'Assertion', and the body size is greater than 2000 bytes. This combination of indicators suggests an attempt to authenticate using a forged SAML assertion.