Techniques › T1606 › AN0717
AN0717 Analytic 0717
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may detect adversaries forging web credentials in IaaS environments by monitoring for anomalous API activity such as AssumeRole or GetFederationToken being executed by unusual principals. These events often correlate with sudden logon sessions from unfamiliar IP addresses or regions. The chain is usually secret material misuse (stolen private key or password) → API request generating a new token → access to high-value resources.</p>
- Detects
- T1606 Forge Web Credentials
- Part of
- DET0260 Detection Strategy for Forged Web Credentials
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | AssumeRole, GetFederationToken API calls by unusual or new entities | DC0006 Web Credential Creation |
| AWS:CloudTrail | Temporary security credentials used to authenticate into management console or APIs | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedRoleMappings | Define expected users and roles allowed to use AssumeRole or federation APIs. |
GeoVelocityThreshold | Alert if the same user authenticates from geographically disparate locations within a short time. |