ADFS Token Issuance Uncorrelated to Primary Authentication (Possible Forged SAML)

Ethan Andrews@eandrews

•updated Jul 7, 2026•11•0•8

Detects Active Directory Federation Services (ADFS) token issuance or claims processing events (Event IDs 299, 1200-1203) that lack a corresponding preceding primary authentication audit event within the same correlation instance. This lack of correlation suggests the SAML assertion was not initiated by a legitimate login, potentially indicating the use of a forged SAML token (Golden SAML attack).