{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1606","id":"T1606","name":"Forge Web Credentials","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1606","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"eab0a17c379843927570c8d26fc0de879385b61ec341cd07f2c61edd5ee426d4","description":"Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.\n\nAdversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.\n\nThe generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation: AWS Temporary Security Credentials)(Citation: Zimbra Preauth)\n\nOnce forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance)  ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1606","external_id":"T1606"},{"source_name":"AWS Temporary Security Credentials","description":"AWS. (n.d.). Requesting temporary security credentials. Retrieved April 1, 2022.","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html"},{"source_name":"Unit 42 Mac Crypto Cookies January 2019","description":"Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"},{"source_name":"GitHub AWS-ADFS-Credential-Generator","description":"Damian Hickey. (2017, January 28). AWS-ADFS-Credential-Generator. Retrieved September 27, 2024.","url":"https://github.com/pvanbuijtene/aws-adfs-credential-generator"},{"source_name":"Microsoft SolarWinds Customer Guidance","description":"MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.","url":"https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"},{"source_name":"Pass The Cookie","description":"Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.","url":"https://wunderwuzzi23.github.io/blog/passthecookie.html"},{"source_name":"Zimbra Preauth","description":"Zimbra. (2023, March 16). Preauth. Retrieved May 31, 2023.","url":"https://wiki.zimbra.com/wiki/Preauth"}],"platforms":["SaaS","Windows","macOS","Linux","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1606.001","id":"T1606.001","name":"Web Cookies","page":"techniques/enterprise/T1606.001/"},{"key":"enterprise/T1606.002","id":"T1606.002","name":"SAML Tokens","page":"techniques/enterprise/T1606.002/"}],"telemetry":[{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0006","name":"Web Credential Creation","page":"telemetry/DC0006/","kind":"attack_component","category":"Identity and SaaS","description":"Creation or issuance of a web credential, application secret, token or related authentication material.","collection_focus":"Collect issuer/admin audit for credential creation with non-secret key or credential ID, owner and expiry; never record the secret value.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["application_id","credential_id","action","expires_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0006","collector":"illustrative-lab-collector","observation":{"application_id":"lab-app","credential_id":"key-lab-1","action":"issue","expires_at":"2026-09-28T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0007","name":"Web Credential Usage","page":"telemetry/DC0007/","kind":"attack_component","category":"Identity and SaaS","description":"Observed use of a web credential during authentication or resource access.","collection_focus":"Join workload/non-interactive sign-in or application access records to non-secret credential identifiers and resource results.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["credential_id","resource","action","result","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0007","collector":"illustrative-lab-collector","observation":{"credential_id":"key-lab-1","resource":"lab-api","action":"authenticate","result":"success","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1606","id":"T1606","name":"Forge Web Credentials","domain":"enterprise","platforms":["SaaS","Windows","macOS","Linux","IaaS","Office Suite","Identity Provider"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1606","technique_page":"techniques/enterprise/T1606/","page":"detections/enterprise/T1606/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"e3393cba-31f0-4207-831e-aef90ab17a8c","title":"SAML Token Issuer Anomaly","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/e3393cba-31f0-4207-831e-aef90ab17a8c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0260","name":"Detection Strategy for Forged Web Credentials","url":"https://attack.mitre.org/detectionstrategies/DET0260","stix_id":"x-mitre-detection-strategy--44f32d03-50ce-480f-b531-481bcc6dc0a8","relationship_id":"relationship--8f9b23a3-d06f-4be8-9073-86cbc90b2164","description":"","analytics":[{"id":"AN0717","name":"Analytic 0717","guidance":"Defenders may detect adversaries forging web credentials in IaaS environments by monitoring for anomalous API activity such as AssumeRole or GetFederationToken being executed by unusual principals. These events often correlate with sudden logon sessions from unfamiliar IP addresses or regions. The chain is usually secret material misuse (stolen private key or password) → API request generating a new token → access to high-value resources.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0717","platforms":["IaaS"],"tuning":[{"field":"AuthorizedRoleMappings","description":"Define expected users and roles allowed to use AssumeRole or federation APIs."},{"field":"GeoVelocityThreshold","description":"Alert if the same user authenticates from geographically disparate locations within a short time."}],"log_sources":[{"component_id":"DC0006","component":"Web Credential Creation","name":"AWS:CloudTrail","channel":"AssumeRole, GetFederationToken API calls by unusual or new entities","platforms":["IaaS"],"analytic_id":"AN0717","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0717","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0006/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"AWS:CloudTrail","channel":"Temporary security credentials used to authenticate into management console or APIs","platforms":["IaaS"],"analytic_id":"AN0717","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0717","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN0718","name":"Analytic 0718","guidance":"Forged web credentials may manifest as anomalous SAML token issuance, OpenID Connect token minting, or Zimbra pre-auth key usage. Defenders may see tokens issued without normal authentication events, multiple valid tokens generated simultaneously, or signing anomalies in IdP logs.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0718","platforms":["Identity Provider"],"tuning":[{"field":"TokenLifetimeThreshold","description":"Limit the maximum time temporary tokens are valid."},{"field":"ExpectedAuthFlows","description":"Define normal authentication flows (e.g., password+MFA) to baseline token issuance."}],"log_sources":[{"component_id":"DC0006","component":"Web Credential Creation","name":"azure:signinlogs","channel":"SAML/OIDC tokens issued without corresponding MFA or password validation","platforms":["Identity Provider"],"analytic_id":"AN0718","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0718","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0006/"},{"component_id":"DC0007","component":"Web Credential Usage","name":"NSM:Connections","channel":"Pre-authentication keys generated or token signing anomalies","platforms":["Identity Provider"],"analytic_id":"AN0718","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0718","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"}]},{"id":"AN0719","name":"Analytic 0719","guidance":"Forged web credentials on Windows endpoints may be detected by anomalous browser cookie files, local token cache manipulations, or tools injecting tokens into sessions. Defenders may observe processes accessing LSASS or browser credential stores unexpectedly, followed by unusual logon sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0719","platforms":["Windows"],"tuning":[{"field":"ProcessWhitelist","description":"Define expected processes that access LSASS or browser credential files."}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0719","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0719","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"EventCode=4624, 4648","platforms":["Windows"],"analytic_id":"AN0719","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0719","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN0720","name":"Analytic 0720","guidance":"On Linux systems, forged credentials may be injected into browser session files, curl/wget headers, or token caches in memory. Detection can leverage auditd to track processes accessing sensitive files (~/.mozilla, ~/.config/chromium, ~/.aws/credentials) and correlate with suspicious outbound connections.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0720","platforms":["Linux"],"tuning":[{"field":"CredentialFilePaths","description":"Define which credential and session files should trigger monitoring."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"Processes reading credential or token cache files","platforms":["Linux"],"analytic_id":"AN0720","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0720","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"WinEventLog:Sysmon","channel":"Outbound requests with forged tokens/cookies in headers","platforms":["Linux"],"analytic_id":"AN0720","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0720","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0721","name":"Analytic 0721","guidance":"Forged credentials on macOS may be visible through Unified Logs showing abnormal access to Keychain or browser session files. Correlated with anomalous web session usage from Safari or Chrome processes outside typical user context.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0721","platforms":["macOS"],"tuning":[{"field":"AuthorizedKeychainApps","description":"List applications that normally request Keychain credentials."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"macos:unifiedlog","channel":"Access to Keychain items or browser credential stores","platforms":["macOS"],"analytic_id":"AN0721","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0721","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0007","component":"Web Credential Usage","name":"macos:unifiedlog","channel":"Web sessions initiated with newly forged tokens","platforms":["macOS"],"analytic_id":"AN0721","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0721","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"}]},{"id":"AN0722","name":"Analytic 0722","guidance":"SaaS platforms may show forged credentials as unusual API keys, tokens, or session cookies being used without corresponding authentication. Correlated patterns include simultaneous valid sessions from multiple geographies, unusual API calls with new tokens, or bypass of expected MFA enforcement.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0722","platforms":["SaaS"],"tuning":[{"field":"GeoLocationAlerts","description":"Trigger on logins from unusual or high-risk geographies."},{"field":"TokenReplayThreshold","description":"Detect multiple simultaneous uses of the same forged credential."}],"log_sources":[{"component_id":"DC0006","component":"Web Credential Creation","name":"m365:unified","channel":"Session creation without MFA or login event","platforms":["SaaS"],"analytic_id":"AN0722","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0722","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0006/"},{"component_id":"DC0007","component":"Web Credential Usage","name":"saas:auth","channel":"API requests made with tokens not associated with expected user logins","platforms":["SaaS"],"analytic_id":"AN0722","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0722","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0007/"}]},{"id":"AN0723","name":"Analytic 0723","guidance":"Forged web credentials in Office Suite contexts may appear as abnormal authentication headers in Outlook or Teams traffic, or unexplained OAuth grants in M365/Azure logs. Defenders should correlate token usage events with missing authentication flows and mismatched device/user context.","url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0723","platforms":["Office Suite"],"tuning":[{"field":"OAuthAppAllowlist","description":"Approved OAuth apps and flows; flag unapproved or unexpected token grants."}],"log_sources":[{"component_id":"DC0006","component":"Web Credential Creation","name":"m365:oauth","channel":"OAuth grants or tokens issued without expected user consent","platforms":["Office Suite"],"analytic_id":"AN0723","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0723","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0006/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"m365:signinlogs","channel":"Token usage events with device/user mismatch","platforms":["Office Suite"],"analytic_id":"AN0723","source_url":"https://attack.mitre.org/detectionstrategies/DET0260#AN0723","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0006","name":"Web Credential Creation","tag":"Web Credential Creation","page":"telemetry/DC0006/","kind":"attack_component"},{"id":"DC0007","name":"Web Credential Usage","tag":"Web Credential Usage","page":"telemetry/DC0007/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Ensure that user accounts with administrative rights follow best practices, including use of privileged access workstations, Just in Time/Just Enough Administration (JIT/JEA), and strong authentication. Reduce the number of users that are members of highly privileged Directory Roles.(Citation: Microsoft SolarWinds Customer Guidance) In AWS environments, prohibit users from calling the `sts:GetFederationToken` API unless explicitly required.(Citation: Crowdstrike AWS User Federation Persistence)","relationship_id":"relationship--f2d946f4-04fe-4b56-8152-80644b6b22d5","references":[{"source_name":"Crowdstrike AWS User Federation Persistence","description":" Vaishnav Murthy and Joel Eng. (2023, January 30). How Adversaries Can Persist with AWS User Federation. Retrieved March 10, 2023.","url":"https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/"},{"source_name":"Microsoft SolarWinds Customer Guidance","description":"MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 17, 2020.","url":"https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Restrict permissions and access to the AD FS server to only originate from privileged access workstations.(Citation: FireEye ADFS)","relationship_id":"relationship--673afcb8-2fb0-4c17-9f91-8fb409943531","references":[{"source_name":"FireEye ADFS","description":"Bierstock, D., Baker, A. (2019, March 21). I am AD FS and So Can You. Retrieved December 17, 2020.","url":"https://www.troopers.de/troopers19/agenda/fpxwmn/"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Administrators should perform an audit of all access lists and the permissions they have been granted to access web applications and services. This should be done extensively on all resources in order to establish a baseline, followed up on with periodic audits of new or updated resources. Suspicious accounts/credentials should be investigated and removed.\n \nEnable advanced auditing on ADFS. Check the success and failure audit options in the ADFS Management snap-in. Enable Audit Application Generated events on the AD FS farm via Group Policy Object.(Citation: FireEye ADFS)","relationship_id":"relationship--da4b552e-fae2-42ef-ac2f-9b61e6ff365a","references":[{"source_name":"FireEye ADFS","description":"Bierstock, D., Baker, A. (2019, March 21). I am AD FS and So Can You. Retrieved December 17, 2020.","url":"https://www.troopers.de/troopers19/agenda/fpxwmn/"}]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Configure browsers/applications to regularly delete persistent web credentials (such as cookies).","relationship_id":"relationship--ce647878-e4d9-4472-9777-b731edbd3d9a","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1539":"/ttp-simulation/techniques/enterprise/T1539/","T1528":"/ttp-simulation/techniques/enterprise/T1528/","T1552.004":"/ttp-simulation/techniques/enterprise/T1552.004/","T1548.005":"/ttp-simulation/techniques/enterprise/T1548.005/","T1550":"/ttp-simulation/techniques/enterprise/T1550/","T1606":"/ttp-simulation/techniques/enterprise/T1606/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1606","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0006","collector":"illustrative-lab-collector","observation":{"application_id":"lab-app","credential_id":"key-lab-1","action":"issue","expires_at":"2026-09-28T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0007","collector":"illustrative-lab-collector","observation":{"credential_id":"key-lab-1","resource":"lab-api","action":"authenticate","result":"success","source_ip":"192.0.2.10"}}]}}