Home/ MITRE Matrix/ Credential Access/ T1606.002

T1606.002SAML Tokens

T1606.002 — SAML Tokens is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 1 detection use case covering it and 1 threat-intel article citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

1Use cases

1Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1606 · Forge Web Credentials

Use cases covering this technique (1)

[LLM] SharePoint STS certificate/thumbprint disclosure endpoint accessed from external IP (CVE-2026-55040 recon) Bespoke recon · alerting SΣP

Articles citing this technique (1)

crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63