Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting GOLDEN SAML Attack

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•93

KQL Query from file: Detecting GOLDEN SAML Attack

Microsoft Sentinel (KQL)

Tags

T1071.001 - Web Protocols T1071 - Application Layer Protocol T1040 - Network Sniffing T1070.004 - File Deletion TA0011 - Command and Control TA0006 - Credential Access TA0007 - Discovery TA0005 - Defense Evasion T1003.002 - Security Account Manager T1606.002 - SAML Tokens T1558.001 - Golden Ticket T1556.007 - Hybrid Identity T1484.002 - Trust Modification T1098.005 - Device Registration T1552.004 - Private Keys S0677 - AADInternals TA0003 - Persistence TA0004 - Privilege Escalation Network Connection HTTP Request Credential Access Windows Azure Windows Defender Atp Saml Idp Generic Active Directory Domain Serviceskql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?