{"id":"T1606","name":"Forge Web Credentials","url":"https://attack.mitre.org/techniques/T1606","tactics":["credential-access"],"platforms":["SaaS","Windows","macOS","Linux","IaaS","Office Suite","Identity Provider"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0260","stix_id":"x-mitre-detection-strategy--44f32d03-50ce-480f-b531-481bcc6dc0a8","name":"Detection Strategy for Forged Web Credentials","url":"https://attack.mitre.org/detectionstrategies/DET0260","analytics":[{"id":"AN0717","stix_id":"x-mitre-analytic--fca70138-f183-4deb-b2a4-59908c76070b","name":"Analytic 0717","description":"Defenders may detect adversaries forging web credentials in IaaS environments by monitoring for anomalous API activity such as AssumeRole or GetFederationToken being executed by unusual principals. These events often correlate with sudden logon sessions from unfamiliar IP addresses or regions. The chain is usually secret material misuse (stolen private key or password) → API request generating a new token → access to high-value resources.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0717","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"AssumeRole, GetFederationToken API calls by unusual or new entities","data_component":"DC0006","data_component_name":"Web Credential Creation","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"Temporary security credentials used to authenticate into management console or APIs","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"AuthorizedRoleMappings","description":"Define expected users and roles allowed to use AssumeRole or federation APIs."},{"field":"GeoVelocityThreshold","description":"Alert if the same user authenticates from geographically disparate locations within a short time."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]},{"id":"AN0718","stix_id":"x-mitre-analytic--d1eafedb-ac64-46b0-972d-8f8759fc11b3","name":"Analytic 0718","description":"Forged web credentials may manifest as anomalous SAML token issuance, OpenID Connect token minting, or Zimbra pre-auth key usage. Defenders may see tokens issued without normal authentication events, multiple valid tokens generated simultaneously, or signing anomalies in IdP logs.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0718","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"SAML/OIDC tokens issued without corresponding MFA or password validation","data_component":"DC0006","data_component_name":"Web Credential Creation","log_source_slug":"azure-signinlogs"},{"name":"NSM:Connections","channel":"Pre-authentication keys generated or token signing anomalies","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"nsm-connections"}],"mutable_elements":[{"field":"TokenLifetimeThreshold","description":"Limit the maximum time temporary tokens are valid."},{"field":"ExpectedAuthFlows","description":"Define normal authentication flows (e.g., password+MFA) to baseline token issuance."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]},{"id":"AN0719","stix_id":"x-mitre-analytic--ff0d2f8d-1fff-4bda-94e6-c0cd50abe6ed","name":"Analytic 0719","description":"Forged web credentials on Windows endpoints may be detected by anomalous browser cookie files, local token cache manipulations, or tools injecting tokens into sessions. Defenders may observe processes accessing LSASS or browser credential stores unexpectedly, followed by unusual logon sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0719","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"ProcessWhitelist","description":"Define expected processes that access LSASS or browser credential files."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]},{"id":"AN0720","stix_id":"x-mitre-analytic--789849fe-7e94-4fd0-904b-02f8c9c0a696","name":"Analytic 0720","description":"On Linux systems, forged credentials may be injected into browser session files, curl/wget headers, or token caches in memory. Detection can leverage auditd to track processes accessing sensitive files (~/.mozilla, ~/.config/chromium, ~/.aws/credentials) and correlate with suspicious outbound connections.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0720","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Processes reading credential or token cache files","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"WinEventLog:Sysmon","channel":"Outbound requests with forged tokens/cookies in headers","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CredentialFilePaths","description":"Define which credential and session files should trigger monitoring."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]},{"id":"AN0721","stix_id":"x-mitre-analytic--b2569010-23c0-4dd8-9e53-3537c1e89efc","name":"Analytic 0721","description":"Forged credentials on macOS may be visible through Unified Logs showing abnormal access to Keychain or browser session files. Correlated with anomalous web session usage from Safari or Chrome processes outside typical user context.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0721","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Access to Keychain items or browser credential stores","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Web sessions initiated with newly forged tokens","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AuthorizedKeychainApps","description":"List applications that normally request Keychain credentials."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]},{"id":"AN0722","stix_id":"x-mitre-analytic--75d43d9f-7b54-4cd4-a6d9-523f8f9a60ff","name":"Analytic 0722","description":"SaaS platforms may show forged credentials as unusual API keys, tokens, or session cookies being used without corresponding authentication. Correlated patterns include simultaneous valid sessions from multiple geographies, unusual API calls with new tokens, or bypass of expected MFA enforcement.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0722","platforms":["SaaS"],"log_source_references":[{"name":"m365:unified","channel":"Session creation without MFA or login event","data_component":"DC0006","data_component_name":"Web Credential Creation","log_source_slug":"m365-unified"},{"name":"saas:auth","channel":"API requests made with tokens not associated with expected user logins","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"saas-auth"}],"mutable_elements":[{"field":"GeoLocationAlerts","description":"Trigger on logins from unusual or high-risk geographies."},{"field":"TokenReplayThreshold","description":"Detect multiple simultaneous uses of the same forged credential."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]},{"id":"AN0723","stix_id":"x-mitre-analytic--9735a0b1-df29-49fe-b0f7-973c0b513e8d","name":"Analytic 0723","description":"Forged web credentials in Office Suite contexts may appear as abnormal authentication headers in Outlook or Teams traffic, or unexplained OAuth grants in M365/Azure logs. Defenders should correlate token usage events with missing authentication flows and mismatched device/user context.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0723","platforms":["Office Suite"],"log_source_references":[{"name":"m365:oauth","channel":"OAuth grants or tokens issued without expected user consent","data_component":"DC0006","data_component_name":"Web Credential Creation","log_source_slug":"m365-oauth"},{"name":"m365:signinlogs","channel":"Token usage events with device/user mismatch","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"m365-signinlogs"}],"mutable_elements":[{"field":"OAuthAppAllowlist","description":"Approved OAuth apps and flows; flag unapproved or unexpected token grants."}],"live":true,"detection_strategies":["DET0260"],"techniques":["T1606"]}],"live":true,"version":"1.0","techniques":["T1606"]}],"sigma_rules":[{"id":"e3393cba-31f0-4207-831e-aef90ab17a8c","title":"SAML Token Issuer Anomaly","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","status":"test","level":"high","date":"2023-09-03","modified":null,"description":"Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns","references":["https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#token-issuer-anomaly","https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins"],"logsource":{"product":"azure","service":"riskdetection"},"tags":["attack.t1606","attack.credential-access"],"path":"rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml","techniques":["T1606"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}