Skip to content

DS0006 Web Credential

Credential material, such as session cookies or tokens, used to authenticate to web applications and services12

Item Value
ID DS0006
Platforms Azure AD, Google Workspace, Linux, Office 365, SaaS, Windows, macOS
Collection Layers Cloud Control Plane, Host
Version 1.0
Created 20 October 2021
Last Modified 30 March 2022

Data Components

Web Credential Creation

Initial construction of new web credential material (ex: Windows EID 1200 or 4769)

Domain ID Name
enterprise T1606 Forge Web Credentials
enterprise T1606.002 SAML Tokens

Web Credential Usage

An attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202)

Domain ID Name
enterprise T1606 Forge Web Credentials
enterprise T1606.001 Web Cookies
enterprise T1606.002 SAML Tokens
enterprise T1550 Use Alternate Authentication Material
enterprise T1550.001 Application Access Token
enterprise T1550.004 Web Session Cookie

References

Back to top