Techniques › T1606 › AN0719
AN0719 Analytic 0719
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Forged web credentials on Windows endpoints may be detected by anomalous browser cookie files, local token cache manipulations, or tools injecting tokens into sessions. Defenders may observe processes accessing LSASS or browser credential stores unexpectedly, followed by unusual logon sessions.</p>
- Detects
- T1606 Forge Web Credentials
- Part of
- DET0260 Detection Strategy for Forged Web Credentials
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ProcessWhitelist | Define expected processes that access LSASS or browser credential files. |