T1606 / ATT&CK

IaaS Analytic 0717

Defenders may detect adversaries forging web credentials in IaaS environments by monitoring for anomalous API activity such as AssumeRole or GetFederationToken being executed by unusual principals. These events often correlate with sudden logon sessions from unfamiliar IP addresses or regions. The chain is usually secret material misuse (stolen private key or password) → API request generating a new token → access to high-value resources.

• AWS:CloudTrail AssumeRole, GetFederationToken API calls by unusual or new entities
• AWS:CloudTrail Temporary security credentials used to authenticate into management console or APIs

Identity Provider Analytic 0718

Forged web credentials may manifest as anomalous SAML token issuance, OpenID Connect token minting, or Zimbra pre-auth key usage. Defenders may see tokens issued without normal authentication events, multiple valid tokens generated simultaneously, or signing anomalies in IdP logs.

• azure:signinlogs SAML/OIDC tokens issued without corresponding MFA or password validation
• NSM:Connections Pre-authentication keys generated or token signing anomalies

Windows Analytic 0719

Forged web credentials on Windows endpoints may be detected by anomalous browser cookie files, local token cache manipulations, or tools injecting tokens into sessions. Defenders may observe processes accessing LSASS or browser credential stores unexpectedly, followed by unusual logon sessions.

• WinEventLog:Sysmon EventCode=10
• WinEventLog:Security EventCode=4624, 4648

Linux Analytic 0720

On Linux systems, forged credentials may be injected into browser session files, curl/wget headers, or token caches in memory. Detection can leverage auditd to track processes accessing sensitive files (~/.mozilla, ~/.config/chromium, ~/.aws/credentials) and correlate with suspicious outbound connections.

• auditd:SYSCALL Processes reading credential or token cache files
• WinEventLog:Sysmon Outbound requests with forged tokens/cookies in headers

macOS Analytic 0721

Forged credentials on macOS may be visible through Unified Logs showing abnormal access to Keychain or browser session files. Correlated with anomalous web session usage from Safari or Chrome processes outside typical user context.

• macos:unifiedlog Access to Keychain items or browser credential stores
• macos:unifiedlog Web sessions initiated with newly forged tokens

SaaS Analytic 0722

SaaS platforms may show forged credentials as unusual API keys, tokens, or session cookies being used without corresponding authentication. Correlated patterns include simultaneous valid sessions from multiple geographies, unusual API calls with new tokens, or bypass of expected MFA enforcement.

• m365:unified Session creation without MFA or login event
• saas:auth API requests made with tokens not associated with expected user logins

Office Suite Analytic 0723

Forged web credentials in Office Suite contexts may appear as abnormal authentication headers in Outlook or Teams traffic, or unexplained OAuth grants in M365/Azure logs. Defenders should correlate token usage events with missing authentication flows and mismatched device/user context.

• m365:oauth OAuth grants or tokens issued without expected user consent
• m365:signinlogs Token usage events with device/user mismatch