MITRE ATT&CK technique

Forge Web Credentials detection rulesT1606

Forge Web Credentials (T1606) is a MITRE ATT&CK technique in the Credential Access tactic. This page lists the 1 community-maintained Sigma detection rule in the library mapped to T1606 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target azure.

T1606 on attack.mitre.org1 rule

Tactic

Credential Access

SAML Token Issuer Anomaly
high
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
azure

Top products

Tactic

SAML Token Issuer Anomaly