Forge Web Credentials T1606
- Tactic
- Credential Access
- Platforms
- SaaS, Windows, macOS, Linux, IaaS, Office Suite, Identity Provider
- Version
- 1.5
- Created
- 17 December 2020
- Last modified
- 24 October 2025
- Contributor
- Dylan Silva, AWS Security
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.
Offense vs defense T1606
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Forge Web Credentials detection strategy DET0260
MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Forged Web Credentials
AN0717 · IaaS
Defenders may detect adversaries forging web credentials in IaaS environments by monitoring for anomalous API activity such as AssumeRole or GetFederationToken being executed by unusual principals. These events often correlate with sudden logon sessions from unfamiliar IP addresses or regions. The chain is usually secret material misuse (stolen private key or password) → API request generating a new token → access to high-value resources.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential CreationDC0006 | AWS:CloudTrail | AssumeRole, GetFederationToken API calls by unusual or new entities |
| Logon Session CreationDC0067 | AWS:CloudTrail | Temporary security credentials used to authenticate into management console or APIs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedRoleMappings | Define expected users and roles allowed to use AssumeRole or federation APIs. |
| GeoVelocityThreshold | Alert if the same user authenticates from geographically disparate locations within a short time. |
AN0718 · Identity Provider
Forged web credentials may manifest as anomalous SAML token issuance, OpenID Connect token minting, or Zimbra pre-auth key usage. Defenders may see tokens issued without normal authentication events, multiple valid tokens generated simultaneously, or signing anomalies in IdP logs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential CreationDC0006 | azure:signinlogs | SAML/OIDC tokens issued without corresponding MFA or password validation |
| Web Credential UsageDC0007 | NSM:Connections | Pre-authentication keys generated or token signing anomalies |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TokenLifetimeThreshold | Limit the maximum time temporary tokens are valid. |
| ExpectedAuthFlows | Define normal authentication flows (e.g., password+MFA) to baseline token issuance. |
AN0719 · Windows
Forged web credentials on Windows endpoints may be detected by anomalous browser cookie files, local token cache manipulations, or tools injecting tokens into sessions. Defenders may observe processes accessing LSASS or browser credential stores unexpectedly, followed by unusual logon sessions.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessWhitelist | Define expected processes that access LSASS or browser credential files. |
AN0720 · Linux
On Linux systems, forged credentials may be injected into browser session files, curl/wget headers, or token caches in memory. Detection can leverage auditd to track processes accessing sensitive files (~/.mozilla, ~/.config/chromium, ~/.aws/credentials) and correlate with suspicious outbound connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | Processes reading credential or token cache files |
| Network Traffic ContentDC0085 | WinEventLog:Sysmon | Outbound requests with forged tokens/cookies in headers |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CredentialFilePaths | Define which credential and session files should trigger monitoring. |
AN0721 · macOS
Forged credentials on macOS may be visible through Unified Logs showing abnormal access to Keychain or browser session files. Correlated with anomalous web session usage from Safari or Chrome processes outside typical user context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential UsageDC0007 | macos:unifiedlog | Web sessions initiated with newly forged tokens |
| Logon Session CreationDC0067 | macos:unifiedlog | Access to Keychain items or browser credential stores |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedKeychainApps | List applications that normally request Keychain credentials. |
AN0722 · SaaS
SaaS platforms may show forged credentials as unusual API keys, tokens, or session cookies being used without corresponding authentication. Correlated patterns include simultaneous valid sessions from multiple geographies, unusual API calls with new tokens, or bypass of expected MFA enforcement.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential CreationDC0006 | m365:unified | Session creation without MFA or login event |
| Web Credential UsageDC0007 | saas:auth | API requests made with tokens not associated with expected user logins |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GeoLocationAlerts | Trigger on logins from unusual or high-risk geographies. |
| TokenReplayThreshold | Detect multiple simultaneous uses of the same forged credential. |
AN0723 · Office Suite
Forged web credentials in Office Suite contexts may appear as abnormal authentication headers in Outlook or Teams traffic, or unexplained OAuth grants in M365/Azure logs. Defenders should correlate token usage events with missing authentication flows and mismatched device/user context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Web Credential CreationDC0006 | m365:oauth | OAuth grants or tokens issued without expected user consent |
| Logon Session CreationDC0067 | m365:signinlogs | Token usage events with device/user mismatch |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| OAuthAppAllowlist | Approved OAuth apps and flows; flag unapproved or unexpected token grants. |
Administrators should perform an audit of all access lists and the permissions they have been granted to access web applications and services. This should be done extensively on all resources in order to establish a baseline, followed up on with periodic audits of new or updated resources. Suspicious accounts/credentials should be investigated and removed. Enable advanced auditing on ADFS. Check the success and failure audit options in the ADFS Management snap-in. Enable Audit Application Generated events on the AD FS farm via Group Policy Object.
Restrict permissions and access to the AD FS server to only originate from privileged access workstations.
Configure browsers/applications to regularly delete persistent web credentials (such as cookies).
Ensure that user accounts with administrative rights follow best practices, including use of privileged access workstations, Just in Time/Just Enough Administration (JIT/JEA), and strong authentication. Reduce the number of users that are members of highly privileged Directory Roles. In AWS environments, prohibit users from calling the sts:GetFederationToken API unless explicitly required.