AUTH-SAML-GOLDENInitial Access

SAML Golden Ticket

Compromise the IdP signing key (via ADFS cert export / Okta admin / leaked cert) — forge arbitrary SAML assertions for any user.

§ Where this technique fits

AUTH-SAML-GOLDEN is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 0 approved dossiers in the registry, typically.