T1606 Forge Web Credentials — Detection & Response
Adversaries may forge credential materials that can be used to gain access to web applications or internet services. Web credentials such as web session cookies, SAML tokens, and OAuth tokens are used by applications to authenticate users. Attackers with access to token-signing keys can forge arbitrary credentials, bypassing authentication entirely without needing the user's password or MFA.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 4+
Threat context
How adversaries use T1606 Forge Web Credentials — Detection & Response
Adversaries may forge credential materials that can be used to gain access to web applications or internet services. Web credentials such as web session cookies, SAML tokens, and OAuth tokens are used by applications to authenticate users. Attackers with access to token-signing keys can forge arbitrary credentials, bypassing authentication entirely without needing the user's password or MFA.
Token forging attacks are among the most advanced and impactful credential attacks. The Golden SAML attack (T1606.002) requires access to the AD FS token-signing certificate and allows an attacker to generate SAML tokens for any user in the organisation, including global administrators, without knowing their passwords or triggering MFA. The 2023 Microsoft China espionage incident involved a forged Microsoft Account (MSA) signing key used to generate valid Outlook Web Access tokens for US government agencies. These attacks are extremely difficult to detect because the forged tokens are cryptographically valid.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| SAML Token Issued for Privileged Account from Unexpected IP A SAML assertion for a Global Administrator or privileged role is issued from an IP address not associated with the AD FS server or federation partner — potential Golden SAML. | Critical | Entra ID / AD FS Logs |
| Token Lifetime Anomaly — Unusually Long Validity Period An access token is issued with a validity period significantly longer than the organisation's configured token lifetime policy — potential forged token with extended validity. | High | Entra ID Sign-in Logs |
| AD FS Certificate Export Event A certificate private key export event (Event 4662 — DACL change or certificate export) on the AD FS server — potential token-signing certificate exfiltration. | Critical | Windows Security Event Log |
| Authentication Without Corresponding MFA Event A user session is created that bypasses the expected MFA step — possible forged token used to skip the authentication challenge. | High | Entra ID / Okta |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1606 Forge Web Credentials — Detection & Response: frequently asked questions
What is the Golden SAML attack?
Golden SAML is an attack where an adversary uses the AD FS token-signing certificate to forge SAML assertions for any user. Unlike the Golden Ticket (Kerberos), Golden SAML tokens are valid for cloud services that trust the AD FS federation. It was used in the SolarWinds post-exploitation phase to access Microsoft 365.
How does ManySignal detect forged tokens given they are cryptographically valid?
ManySignal detects forged tokens by anomaly — not cryptographic validation. Indicators include: tokens issued from unexpected IP addresses, tokens for privileged accounts without corresponding MFA events, tokens with unusual lifetime or claim values, and authentication from non-corporate IP ranges for accounts requiring MFA.
What was the 2023 Microsoft token forging incident?
A threat actor (Storm-0558, associated with Chinese espionage) obtained a Microsoft Account (MSA) signing key and used it to forge tokens for Outlook Web Access, gaining access to email accounts at US government agencies. The key was obtained through a complex chain involving a crash dump from a Microsoft signing system.
Does Conditional Access prevent Golden SAML attacks?
Standard Conditional Access policies rely on token claims provided by the IdP — a Golden SAML token can include forged claims that satisfy Conditional Access conditions. Conditional Access Token Protection (binding tokens to devices) is the most effective countermeasure.
How can I detect if my AD FS token-signing certificate has been exported?
Windows Security Event ID 4662 (DACL change on certificate) and Sysmon Event ID 8 (certificate export) on the AD FS server are the primary indicators. ManySignal ingests these events via the Windows Security connector.
Is this attack still relevant given the push to Entra ID native authentication?
Yes — many organisations still use AD FS for specific applications or hybrid scenarios. Additionally, T1606.001 (cookie forging) is relevant for any web application, not just AD FS deployments. The technique evolved as attackers target other token issuers beyond AD FS.
What is the difference between token theft (T1528) and token forgery (T1606)?
Token theft steals an existing valid token and replays it. Token forgery creates a new, cryptographically valid token from scratch using a signing key. Forgery is more powerful because there is no stolen token to revoke — the adversary can generate tokens at will until the signing key is rotated.
Can ManySignal detect T1606 if I've already migrated to Entra ID native auth?
Yes. After migration from AD FS, the AD FS attack surface is eliminated, but T1606.001 (cookie forging) and other web credential forgery techniques remain relevant. ManySignal monitors Entra ID token issuance for anomalies regardless of federation configuration.
How quickly should AD FS token-signing certificates be rotated after a suspected compromise?
Immediately. Token-signing certificate rotation invalidates all existing SAML tokens and forces re-authentication. Test the rotation procedure in a non-production environment before executing in production, as it can disrupt federated services.
Does ManySignal integrate with Entra ID's new token protection features?
ManySignal ingests Entra ID sign-in logs including token protection policy evaluation results. Sign-in attempts that fail token protection validation are treated as high-priority events.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.