Forge Web Credentials `T1606`

Tactic: Credential Access

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Events covered

5 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Defender-DeviceEvents	any	Defender event
Defender-DeviceNetworkEvents	ConnectionSuccess	Connection succeeded
Defender-DeviceNetworkInfo	any	Device network configuration
Defender-ExposureGraphEdges	any	Exposure graph edges
Defender-ExposureGraphNodes	any	Exposure graph nodes

Authoring guide

These 17 rules share fields, values, and exclusions.

Fields filtered most (55 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`ActionType`	5	`starts_with` 5, `eq` 2	`AppControl`, `ConnectionSuccess`
`file_name`	5	`eq` 5	`ncrypt.dll`, `microsoftaccounttokenprovider.dll`
`parent_process_name`	4	`contains` 2, `ne` 2	`microsoft.tri.sensor.exe`, `powershell`, `python`
`DestinationHostname`	3	`eq` 3	`login.microsoftonline.com`
`GlobalPrevalence`	3	`lt` 3	`250`
`IncomingTokenType`	3	`eq` 3, `ne` 2	`none`, `primaryRefreshToken`
`type`	3	`eq` 3	`DeviceInventoryId`, `IdentityProvider`
`AppDisplayName`	2	`cross_field_compare` 1, `eq` 1	`Azure Portal`, `SecondAppDisplayName`
`AppId`	2	`eq` 2	`FociClientApplications`
`DestinationPort`	2	`eq` 2	`3389`
`HomeTenantId`	2	`cross_field_compare` 2	`ResourceTenantId`
`NodeLabel`	2	`eq` 2	`device`
`OnboardingStatus`	2	`ne` 2	`Onboarded`
`SecondAppDisplayName`	2	`in` 2	`Microsoft Azure CLI`, `Microsoft Azure PowerShell`, `Copilot App`, `Office 365 Management`
`TimeDiff`	2	`ge` 2, `le` 1	`0`, `1`, `90`

Top indicator values (100 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`ActionType`	`starts_with`	`AppControl` kustoDetect device token stealing with WDAC kustoDetect Suspicious ncrypt.dll usage by CLI tool or unknown process kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	5	5
`ActionType`	`starts_with`	`ConnectionSuccess` kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce	1
`file_name`	`eq`	`ncrypt.dll` kustoDetect Suspicious ncrypt.dll usage by CLI tool or unknown process kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	4	4
`DestinationHostname`	`eq`	`login.microsoftonline.com` kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	3	3
`GlobalPrevalence`	`lt`	`250` kustoDetect device token stealing with WDAC kustoDetect Suspicious ncrypt.dll usage by CLI tool or unknown process kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce	3	4
`ActionType`	`eq`	`ConnectionSuccess` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	11
`AppId`	`eq`	`FociClientApplications` kustoDetect suspicious foci token logins kustoDetect suspicious foci token logins V2	2	2
`DestinationPort`	`eq`	`3389` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	12
`HomeTenantId`	`cross_field_compare`	`ResourceTenantId` kustoDetect suspicious foci token logins kustoDetect suspicious foci token logins V2	2	3
`IncomingTokenType`	`eq`	`none` kustoDetect suspicious foci token logins kustoDetect suspicious foci token logins V2	2	2
`IncomingTokenType`	`ne`	`none` kustoDetect suspicious foci token logins kustoDetect suspicious foci token logins V2	2	2
`NodeLabel`	`eq`	`device` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	3
`OnboardingStatus`	`ne`	`Onboarded` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	5
`SecondAppDisplayName`	`in`	`Microsoft Azure CLI` kustoDetect suspicious foci token logins kustoDetect suspicious foci token logins V2	2	2
`SecondAppDisplayName`	`in`	`Microsoft Azure PowerShell` kustoDetect suspicious foci token logins kustoDetect suspicious foci token logins V2	2	2
`TpmActivated`	`ne`	`true` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	4
`TpmEnabled`	`ne`	`true` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	4
`TpmSupported`	`ne`	`true` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	4
`event.category`	`eq`	`authentication` elasticFortiGate FortiCloud SSO Login from Unusual Source elasticM365 Identity Unusual SSO Authentication Errors for User	2	34
`parent_process_name`	`contains`	`powershell` kustoDetect Suspicious ncrypt.dll usage by CLI tool or unknown process kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce	2	2
`parent_process_name`	`contains`	`python` kustoDetect Suspicious ncrypt.dll usage by CLI tool or unknown process kustoDetect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce	2	2
`parent_process_name`	`ne`	`microsoft.tri.sensor.exe` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	3
`type`	`eq`	`DeviceInventoryId` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2	5
`ActivityType`	`contains`	`credentialaccess:rds/anomalousbehavior.successfulbruteforce` kustoCross-Cloud Unauthorized Credential Access Detection From AWS RDS Login	1	2
`ActivityType`	`contains`	`credentialaccess:rds/anomalousbehavior.successfullogin` kustoCross-Cloud Unauthorized Credential Access Detection From AWS RDS Login	1
`ActivityType`	`contains`	`credentialaccess:rds/maliciousipcaller.failedlogin` kustoCross-Cloud Unauthorized Credential Access Detection From AWS RDS Login	1
`ActivityType`	`contains`	`credentialaccess:rds/maliciousipcaller.successfullogin` kustoCross-Cloud Unauthorized Credential Access Detection From AWS RDS Login	1
`ActivityType`	`contains`	`credentialaccess:rds/toripcaller.failedlogin` kustoCross-Cloud Unauthorized Credential Access Detection From AWS RDS Login	1	2
`ActivityType`	`contains`	`credentialaccess:rds/toripcaller.successfullogin` kustoCross-Cloud Unauthorized Credential Access Detection From AWS RDS Login	1	2
`AppDisplayName`	`cross_field_compare`	`SecondAppDisplayName` kustoDetect suspicious foci token logins	1

Exclusions (2 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`parent_process_name`	`in`	`backgroundtaskhost.exe` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2
`parent_process_name`	`in`	`svchost.exe` kustoDetect Suspicious ncrypt.dll usage on admin device with RDP connections to non TPM protected device kustoDetect Suspicious ncrypt.dll usage with RDP connections to unmanaged or non TPM protected device	2

Forge Web Credentials `T1606`

Events covered

Authoring guide

Fields filtered most (55 distinct)

Top indicator values (100 distinct)

Exclusions (2 distinct)

Rules under this technique

Sigma 1 rule

Elastic 2 rules

Kusto 14 rules

Forge Web Credentials T1606

Events covered

Authoring guide

Fields filtered most (55 distinct)

Top indicator values (100 distinct)

Exclusions (2 distinct)

Rules under this technique

Sigma 1 rule

Elastic 2 rules

Kusto 14 rules

Forge Web Credentials `T1606`