ATT&CK technique
View on MITRE ATT&CK →
T1606
Forge Web Credentials
Credential Access
4 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | FortiGate FortiCloud SSO Login from Unusual Source | production | 2026-09-28 |
| elastic | M365 Identity Unusual SSO Authentication Errors for User | production | 2026-09-18 |
| elastic | AWS GetFederationToken Followed by Console Login via Federation Exchange | production | 2026-08-14 |
| sigma | SAML Token Issuer Anomaly | test | 2023-09-03 |