Forge Web Credentials

Technique · ATTACK:enterprise:T1606

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1606",
  "title": "Forge Web Credentials",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1606",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--94cb00a4-b295-4d06-aa2b-5653b9c1be9c",
  "external_id": "T1606",
  "domain": "enterprise",
  "created": "2020-12-17T02:13:46.247Z",
  "modified": "2025-10-24T17:49:07.201Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "AWS Temporary Security Credentials",
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html"
    },
    {
      "source_name": "Unit 42 Mac Crypto Cookies January 2019",
      "url": "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"
    },
    {
      "source_name": "GitHub AWS-ADFS-Credential-Generator",
      "url": "https://github.com/pvanbuijtene/aws-adfs-credential-generator"
    },
    {
      "source_name": "Microsoft SolarWinds Customer Guidance",
      "url": "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/"
    },
    {
      "source_name": "Pass The Cookie",
      "url": "https://wunderwuzzi23.github.io/blog/passthecookie.html"
    },
    {
      "source_name": "Zimbra Preauth",
      "url": "https://wiki.zimbra.com/wiki/Preauth"
    }
  ]
}

Explicit source assertions (6)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.