Techniques › T1606
T1606 Forge Web Credentials
credential access — SaaS, Windows, macOS, Linux, IaaS, Office Suite, Identity Provider · attack.mitre.org · JSON
1
MITRE detection strategy
7
analytics
1
Sigma rules tagged attack.t1606
0
KEV CVEs mapped here
<p>Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.</p><p>Adversaries may generate these credential materials in order to gain access to web resources. This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.</p><p>The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values. Adversaries may also forge tokens by taking advantage of features such as the
AssumeRole and GetFederationToken APIs in AWS, which allow users to request temporary security credentials (i.e., Temporary Elevated Cloud Access), or the zmprov gdpak command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.</p><p>Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0260 Detection Strategy for Forged Web Credentials v1.0
AN0717 IaaSDefenders may detect adversaries forging web credentials in IaaS environments by monitoring for anomalous API activity such as AssumeRole or GetFederationToken being executed by unusual principals. These events often correlate with sudden logon sessions from unfamiliar IP addresses or regions. The chain is usually secret material misuse (stolen private key or password) → API request generating a new token → access to high-value resources.AWS:CloudTrail
AssumeRole, GetFederationToken API calls by unusual or new entities→ DC0006 Web Credential CreationAWS:CloudTrailTemporary security credentials used to authenticate into management console or APIs→ DC0067 Logon Session CreationTunable:AuthorizedRoleMappingsGeoVelocityThresholdAN0718 Identity ProviderForged web credentials may manifest as anomalous SAML token issuance, OpenID Connect token minting, or Zimbra pre-auth key usage. Defenders may see tokens issued without normal authentication events, multiple valid tokens generated simultaneously, or signing anomalies in IdP logs.azure:signinlogsSAML/OIDC tokens issued without corresponding MFA or password validation→ DC0006 Web Credential CreationNSM:ConnectionsPre-authentication keys generated or token signing anomalies→ DC0007 Web Credential UsageTunable:TokenLifetimeThresholdExpectedAuthFlowsAN0719 WindowsForged web credentials on Windows endpoints may be detected by anomalous browser cookie files, local token cache manipulations, or tools injecting tokens into sessions. Defenders may observe processes accessing LSASS or browser credential stores unexpectedly, followed by unusual logon sessions.Tunable:ProcessWhitelistAN0720 LinuxOn Linux systems, forged credentials may be injected into browser session files, curl/wget headers, or token caches in memory. Detection can leverage auditd to track processes accessing sensitive files (~/.mozilla, ~/.config/chromium, ~/.aws/credentials) and correlate with suspicious outbound connections.WinEventLog:SysmonOutbound requests with forged tokens/cookies in headers→ DC0085 Network Traffic ContentTunable:CredentialFilePathsAN0721 macOSForged credentials on macOS may be visible through Unified Logs showing abnormal access to Keychain or browser session files. Correlated with anomalous web session usage from Safari or Chrome processes outside typical user context.macos:unifiedlogAccess to Keychain items or browser credential stores→ DC0067 Logon Session CreationTunable:AuthorizedKeychainAppsAN0722 SaaSSaaS platforms may show forged credentials as unusual API keys, tokens, or session cookies being used without corresponding authentication. Correlated patterns include simultaneous valid sessions from multiple geographies, unusual API calls with new tokens, or bypass of expected MFA enforcement.saas:authAPI requests made with tokens not associated with expected user logins→ DC0007 Web Credential UsageTunable:GeoLocationAlertsTokenReplayThresholdAN0723 Office SuiteForged web credentials in Office Suite contexts may appear as abnormal authentication headers in Outlook or Teams traffic, or unexplained OAuth grants in M365/Azure logs. Defenders should correlate token usage events with missing authentication flows and mismatched device/user context.m365:oauthOAuth grants or tokens issued without expected user consent→ DC0006 Web Credential CreationTunable:OAuthAppAllowlist
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1606
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · e3393cba-31f0-4207-831e-aef90ab17a8c
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns