Web Credential

Credential material, such as session cookies or tokens, used to authenticate to web applications and services^[1]^[2]

ID: DS0006

ⓘ

Platforms: Azure AD, Google Workspace, Linux, Office 365, SaaS, Windows, macOS

ⓘ

Collection Layers: Cloud Control Plane, Host

Version: 1.0

Created: 20 October 2021

Last Modified: 20 October 2021

Data Components

Initial construction of new web credential material (ex: Windows EID 1200 or 4769)

Initial construction of new web credential material (ex: Windows EID 1200 or 4769)

An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)

An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)

Domain	ID		Name
Enterprise	T1606		Forge Web Credentials
		.001	Web Cookies
		.002	SAML Tokens
Enterprise	T1550		Use Alternate Authentication Material
		.001	Application Access Token
		.004	Web Session Cookie