Home/ MITRE Matrix/ Credential Access/ T1606.002

T1606.002SAML Tokens

T1606.002 — SAML Tokens is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 2 detection use cases covering it and 2 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

2Use cases

2Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1606 · Forge Web Credentials

Use cases covering this technique (2)

[LLM] SAP NetWeaver SAML XML signature wrapping anomaly (CVE-2026-44748) Bespoke exploit · hunting DSPDD [LLM] ROADtools roadtx FOCI client-ID swap: refresh-token resource hop across MS Office FOCI app IDs Bespoke c2 · hunting DSPDD

Articles citing this technique (2)

crit Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities art-61

crit Paved With Intent: ROADtools and Nation-State Tactics in the Cloud art-218