Steal Web Session Cookie T1539
Tactic: Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Events covered
5 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceEvents | any | Defender event |
| ESF | exec | Process Execution |
| ESF | open | File Open |
Authoring guide
These 37 rules share fields, values, and exclusions.
Fields filtered most (85 distinct)
These fields appear most often in rule filters.
Top indicator values (237 distinct)
These values appear most often in rule predicates.
Exclusions (405 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 2 rules
Elastic 28 rules
- Access to Browser Credentials from Suspicious Memory
- AWS IAM User Console Login from Multiple Geolocations
- Browser Debugging from Unusual Parent
- Browser Process Spawned from an Unusual Parent
- Chrome Browser Spawned from an Unusual Parent
- Entra ID Device-Bound PRT from Unusual Device IP
- Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP
- Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent
- Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA)
- Failed Access Attempt to Web Browser Files
- Failed Attempts to Access Sensitive Files
- First Time Python Accessed Sensitive Credential Files
- M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA)
- Manual Loading of a Suspicious Chromium Extension
- Multiple Device Token Hashes for Single Okta Session
- Okta AiTM Session Cookie Replay
- Okta Multiple OS Names Detected for a Single DT Hash
- Potential Browser Credentials Stealer
- Potential Browser Debugging via Localhost
- Potential Cookies Theft via Browser Debugging
- Potential Entra ID PRT Extraction via BrowserCore
- Suspicious Access to Web Browser Credential Stores
- Suspicious Web Browser Sensitive File Access
- Web Browser Credential Access via Scripting Utility
- Web Browser Credential Access via Unsigned Process
- Web Browser Credential Data Accessed by Osascript
- Web Browser Credential Data Accessed by Unsigned or Untrusted Process
- WebProxy Settings Modification