Steal Web Session Cookie `T1539`

Tactic: Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Events covered

5 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.
Defender-DeviceEvents	any	Defender event
ESF	exec	Process Execution
ESF	open	File Open

Authoring guide

These 34 rules share fields, values, and exclusions.

Fields filtered most (77 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	17	`eq` 15, `in` 2	`open`, `exec`, `sign-in activity`, `start`, `connection_accepted`
`process_name`	13	`eq` 6, `in` 3, `is_not_null` 2, `starts_with` 1, `wildcard` 1	`chrome.exe`, `msedge.exe`, `google chrome`, `osascript`, `autoit*.exe`
`Image`	10	`is_not_null` 7, `ends_with` 2, `eq` 1	`\sqlite.exe`, `\sqlite3.exe`, `?:\program files (x86)\google\chrome\application\chrome.exe`, `?:\program files (x86)\microsoft\edge\application\msedge.exe`, `?:\program files\google\chrome\application\chrome.exe`
`event.type`	9	`eq` 7, `in` 2	`start`, `access`, `process_started`, `info`
`file.name`	7	`eq` 7	`cookies.sqlite`, `cert?.db`, `cookies`, `cookies.binarycookies`, `key?.db`
`TargetFilename`	6	`wildcard` 6, `starts_with` 1	`?:\users\\appdata\local\google\chrome\user...`, `?:\users\\appdata\local\google\chrome\user data\local state`, `?:\users\\appdata\local\microsoft\edge\user...`, `?:\`, `?:\users\\appdata\*\filezilla\recentservers.xml`
`process.args`	6	`starts_with` 3, `eq` 2, `in` 1, `wildcard` 1	`--remote-debugging-pipe=`, `--remote-debugging-port=`, `--remote-debugging-targets=`, `--load-extension=/`, `--profile-directory="default"`
`data_stream.dataset`	5	`eq` 5	`azure.signinlogs`, `okta.system`, `o365.audit`
`event.outcome`	5	`eq` 5	`success`, `failure`
`host.os.type`	5	`eq` 5
`process.code_signature.trusted`	5	`eq` 4, `ne` 1	`false`, `true`
`process_id`	5	`ne` 5	`4`
`event.category`	4	`eq` 3, `in` 1	`authentication`, `file`, `registry`
`CommandLine`	3	`contains` 2, `wildcard` 1	`"C:\Program Files\Google\Chrome\Application\chrome.exe"...`, `"C:\Program Files\Google\Chrome\Application\chrome.exe"...`, `"C:\Program Files\Google\Chrome\Application\chrome.exe"...`, `\chromiumviewer\`, `\opera software\`
`ParentImage`	3	`is_not_null` 3

Top indicator values (195 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`file.name`	`eq`	`cookies.sqlite` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Access via Unsigned Process elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	6	11
`file.name`	`eq`	`key?.db` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Access via Unsigned Process elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	6	11
`file.name`	`eq`	`logins.json` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Access via Unsigned Process elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	6	11
`file.name`	`eq`	`cert?.db` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Unsigned Process	3	3
`file.name`	`eq`	`cookies` elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	3	8
`file.name`	`eq`	`cookies.binarycookies` elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	3	8
`file.name`	`eq`	`login data` elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	3	8
`file.name`	`eq`	`signons.sqlite` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Unsigned Process	3	4
`EventType`	`eq`	`open` elasticFirst Time Python Accessed Sensitive Credential Files elasticSuspicious Access to Web Browser Credential Stores elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Data Accessed by Osascript elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	5	52
`EventType`	`eq`	`exec` elasticManual Loading of a Suspicious Chromium Extension elasticWebProxy Settings Modification	2	576
`EventType`	`eq`	`sign-in activity` elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent elasticEntra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)	2	7
`EventType`	`eq`	`start` elasticWeb Browser Credential Access via Scripting Utility elasticWeb Browser Credential Access via Unsigned Process	2	391
`process_id`	`ne`	`4` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticFailed Attempts to Access Sensitive Files elasticPotential Browser Credentials Stealer elasticPotential Browser Debugging via Localhost	5	44
`TargetFilename`	`wildcard`	`?:\users\*\appdata\local\google\chrome\user data\default\login data` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Scripting Utility elasticWeb Browser Credential Access via Unsigned Process	4	4
`TargetFilename`	`wildcard`	`?:\users\*\appdata\local\google\chrome\user data\local state` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Scripting Utility elasticWeb Browser Credential Access via Unsigned Process	4	4
`TargetFilename`	`wildcard`	`?:\users\*\appdata\local\microsoft\edge\user data\default\login data` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Scripting Utility elasticWeb Browser Credential Access via Unsigned Process	4	4
`TargetFilename`	`wildcard`	`?:\users\*\appdata\local\microsoft\edge\user data\local state` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Scripting Utility elasticWeb Browser Credential Access via Unsigned Process	4	4
`event.type`	`eq`	`access` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files elasticWeb Browser Credential Access via Scripting Utility elasticWeb Browser Credential Access via Unsigned Process	4	10
`event.type`	`eq`	`start` elasticBrowser Debugging from Unusual Parent elasticBrowser Process Spawned from an Unusual Parent elasticChrome Browser Spawned from an Unusual Parent	3	1078
`event.outcome`	`eq`	`success` elasticAccess to Browser Credentials from Suspicious Memory elasticAWS IAM User Console Login from Multiple Geolocations elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent	3	369
`process.code_signature.exists`	`eq`	`false` elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Access via Unsigned Process elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	3	119
`process.code_signature.trusted`	`eq`	`false` elasticSuspicious Web Browser Sensitive File Access elasticWeb Browser Credential Access via Unsigned Process elasticWeb Browser Credential Data Accessed by Unsigned or Untrusted Process	3	115
`process_name`	`eq`	`chrome.exe` elasticBrowser Debugging from Unusual Parent elasticBrowser Process Spawned from an Unusual Parent elasticChrome Browser Spawned from an Unusual Parent	3	16
`Image`	`ends_with`	`\sqlite.exe` sigmaSQLite Chromium Profile Data DB Access sigmaSQLite Firefox Profile Data DB Access	2	2
`Image`	`ends_with`	`\sqlite3.exe` sigmaSQLite Chromium Profile Data DB Access sigmaSQLite Firefox Profile Data DB Access	2	2
`Product`	`eq`	`sqlite` sigmaSQLite Chromium Profile Data DB Access sigmaSQLite Firefox Profile Data DB Access	2	2
`aws::userAgent`	`eq`	`node` elasticEntra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) elasticM365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)	2	2
`aws::userAgent`	`eq`	`undici` elasticEntra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) elasticM365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)	2	2
`aws::userAgent`	`starts_with`	`axios` elasticEntra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) elasticM365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)	2	3
`azure_ad::app_id`	`eq`	`29d9ed98-a469-4536-ade2-f981bc1d605e` elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent elasticEntra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)	2	8

Exclusions (398 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticFailed Access Attempt to Web Browser Files elasticSuspicious Access to Web Browser Credential Stores elasticWeb Browser Credential Access via Unsigned Process	3
`Image`	`wildcard`	`?:\program files\*.exe` elasticFailed Access Attempt to Web Browser Files elasticSuspicious Access to Web Browser Credential Stores elasticWeb Browser Credential Access via Unsigned Process	3
`Image`	`wildcard`	`?:\programdata\microsoft\windows defender\platform\*\msmpeng.exe` elasticFailed Access Attempt to Web Browser Files elasticSuspicious Access to Web Browser Credential Stores	2
`user.id`	`eq`	`s-1-5-18` elasticAccess to Browser Credentials from Suspicious Memory elasticBrowser Debugging from Unusual Parent elasticFailed Access Attempt to Web Browser Files	3
`Signature`	`eq`	`Guardicore Ltd` elasticAccess to Browser Credentials from Suspicious Memory elasticWeb Browser Credential Access via Unsigned Process	2
`Signature`	`wildcard`	`7270356 Canada Inc.` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Beijing Qihu Technology Co., Ltd.` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Bitdefender SRL` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Bromium, Inc.` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Canva` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Eric R. Zimmerman` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Exclaimer Ltd` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Google LLC` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Grammarly, Inc.` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2
`Signature`	`wildcard`	`Lenovo` elasticAccess to Browser Credentials from Suspicious Memory elasticFailed Access Attempt to Web Browser Files	2

Steal Web Session Cookie `T1539`

Events covered

Authoring guide

Fields filtered most (77 distinct)

Top indicator values (195 distinct)

Exclusions (398 distinct)

Rules under this technique

Sigma 2 rules

Elastic 25 rules

Splunk 1 rule

Kusto 1 rule

YARA-L 1 rule

Panther 4 rules

Steal Web Session Cookie T1539

Events covered

Authoring guide

Fields filtered most (77 distinct)

Top indicator values (195 distinct)

Exclusions (398 distinct)

Rules under this technique

Sigma 2 rules

Elastic 25 rules

Splunk 1 rule

Kusto 1 rule

YARA-L 1 rule

Panther 4 rules

Steal Web Session Cookie `T1539`