{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1539","id":"T1539","name":"Steal Web Session Cookie","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1539","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b8e486788d9d5b9df772422048f9184d30032e11426dcbaaebc7fd4a9550169e","description":"An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on [User Execution](https://attack.mitre.org/techniques/T1204) by tricking victims into running malicious JavaScript in their browser.(Citation: Talos Roblox Scam 2023)(Citation: Krebs Discord Bookmarks 2023)\n\nThere are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1539","external_id":"T1539"},{"source_name":"Krebs Discord Bookmarks 2023","description":"Brian Krebs. (2023, May 30). Discord Admins Hacked by Malicious Bookmarks. Retrieved January 2, 2024.","url":"https://krebsonsecurity.com/2023/05/discord-admins-hacked-by-malicious-bookmarks/"},{"source_name":"Unit 42 Mac Crypto Cookies January 2019","description":"Chen, Y., Hu, W., Xu, Z., et. al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved October 14, 2019.","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"},{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"},{"source_name":"Github evilginx2","description":"Gretzky, Kuba. (2019, April 10). Retrieved October 8, 2019.","url":"https://github.com/kgretzky/evilginx2"},{"source_name":"GitHub Mauraena","description":"Orrù, M., Trotta, G.. (2019, September 11). Muraena. Retrieved October 14, 2019.","url":"https://github.com/muraenateam/muraena"},{"source_name":"Pass The Cookie","description":"Rehberger, J. (2018, December). Pivot to the Cloud using Pass the Cookie. Retrieved April 5, 2019.","url":"https://wunderwuzzi23.github.io/blog/passthecookie.html"},{"source_name":"Talos Roblox Scam 2023","description":"Tiago Pereira. (2023, November 2). Attackers use JavaScript URLs, API forms and more to scam users in popular online game “Roblox”. Retrieved January 2, 2024.","url":"https://blog.talosintelligence.com/roblox-scam-overview/"}],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"enterprise/T1539","id":"T1539","name":"Steal Web Session Cookie","domain":"enterprise","platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1539","technique_page":"techniques/enterprise/T1539/","page":"detections/enterprise/T1539/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"24c77512-782b-448a-8950-eddb0785fc71","title":"SQLite Chromium Profile Data DB Access","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/24c77512-782b-448a-8950-eddb0785fc71.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml","author":"TropChaud","kind":"sigma"},{"id":"4833155a-4053-4c9c-a997-777fcea0baa7","title":"SQLite Firefox Profile Data DB Access","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4833155a-4053-4c9c-a997-777fcea0baa7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0509","name":"Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts","url":"https://attack.mitre.org/detectionstrategies/DET0509","stix_id":"x-mitre-detection-strategy--26fdbcb2-abc1-4844-8e5d-2c6039336cb7","relationship_id":"relationship--e664a59e-9529-43cd-bac0-0ff1ced6a41f","description":"","analytics":[{"id":"AN1402","name":"Analytic 1402","guidance":"Detects suspicious access to browser session cookie storage (e.g., Chrome’s `Cookies` SQLite DB) or memory reads of browser processes. Anomalous injection or memory dump utilities targeting browser processes such as `chrome.exe`, `firefox.exe`, or `msedge.exe`.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1402","platforms":["Windows"],"tuning":[{"field":"TargetProcessList","description":"Monitored browsers (e.g., chrome.exe, firefox.exe)"},{"field":"AccessToolList","description":"Suspicious tools used for injection or memory access (e.g., mimikatz, procdump)"},{"field":"TargetCookiePaths","description":"Locations of cookie stores like `AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies`"}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN1402","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1402","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0061","component":"File Modification","name":"WinEventLog:Sysmon","channel":"EventCode=2","platforms":["Windows"],"analytic_id":"AN1402","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1402","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1402","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1402","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1403","name":"Analytic 1403","guidance":"Detects access to known browser cookie files (e.g., `~/.mozilla/firefox/*.default/cookies.sqlite`, `~/.config/google-chrome/`) and suspicious reads of browser memory via `/proc/[pid]/mem` or ptrace.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1403","platforms":["Linux"],"tuning":[{"field":"CookieFilePatterns","description":"Regex paths to known browser cookie locations"},{"field":"TimeWindow","description":"Correlated time range between cookie read and web upload or process injection"},{"field":"BrowserProcPatterns","description":"Expected names for browser processes being accessed"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open or read to browser cookie storage","platforms":["Linux"],"analytic_id":"AN1403","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1403","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0035","component":"Process Access","name":"auditd:SYSCALL","channel":"ptrace syscall or access to /proc/*/mem","platforms":["Linux"],"analytic_id":"AN1403","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1403","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN1404","name":"Analytic 1404","guidance":"Detects unauthorized access to browser cookie paths (e.g., `~/Library/Application Support/Google/Chrome/Default/Cookies`) or `task_for_pid`/`vm_read` calls to Safari/Chrome memory space.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1404","platforms":["macOS"],"tuning":[{"field":"TargetBrowserList","description":"List of processes considered web browsers on macOS"},{"field":"BrowserCookiePathList","description":"Cookie database paths specific to each browser"}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"macos:unifiedlog","channel":"vm_read, task_for_pid, or file open to cookie databases","platforms":["macOS"],"analytic_id":"AN1404","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1404","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0055","component":"File Access","name":"fs:fsusage","channel":"file open for known browser cookie paths","platforms":["macOS"],"analytic_id":"AN1404","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1404","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1405","name":"Analytic 1405","guidance":"Detects automation macros or VBA scripts in documents that access browser file paths, read cookie data, or attempt to exfiltrate browser session tokens over HTTP.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1405","platforms":["Office Suite"],"tuning":[{"field":"MacroTargetPath","description":"Files or directories macros are attempting to access"},{"field":"HTTPDestinationIPList","description":"List of IPs or domains that are uncommon for macro-based HTTP POSTs"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"RunMacro","platforms":["Office Suite"],"analytic_id":"AN1405","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1405","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0061","component":"File Modification","name":"WinEventLog:Sysmon","channel":"EventCode=2","platforms":["Office Suite"],"analytic_id":"AN1405","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1405","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN1406","name":"Analytic 1406","guidance":"Detects use of session cookies or authentication tokens from unusual user agents or locations. Identifies token reuse without reauthentication or attempts to bypass MFA using previously stolen cookies.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1406","platforms":["SaaS"],"tuning":[{"field":"TokenReuseTimeWindow","description":"Max allowed delta between token issuance and second use"},{"field":"UserAgentAnomalyScore","description":"Deviation score from normal browser/device fingerprint"},{"field":"GeoLocationAnomalyScore","description":"Deviation in IP region or ASN per user profile"}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"saas:googleworkspace","channel":"login with reused session token and mismatched user agent or IP","platforms":["SaaS"],"analytic_id":"AN1406","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1406","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"saas:okta","channel":"session.token.reuse","platforms":["SaaS"],"analytic_id":"AN1406","source_url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1406","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S9003","name":"evilginx2","page":"tools/S9003/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S9003","name":"evilginx2","page":"tools/S9003/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--b9b622ad-856a-48f9-a768-ef05bd2914fe","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0492","name":"CookieMiner","url":"https://attack.mitre.org/software/S0492","kind":"malware","description":"[CookieMiner](https://attack.mitre.org/software/S0492) can steal Google Chrome and Apple Safari browser cookies from the victim’s machine. (Citation: Unit42 CookieMiner Jan 2019)","relationship_id":"relationship--474e148d-4f4a-41d4-994e-d6425c7445f3","references":[{"source_name":"Unit42 CookieMiner Jan 2019","description":"Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can steal the victim's cookies to use for duplicating the active session from another device.(Citation: IBM Grandoreiro April 2020)","relationship_id":"relationship--1e526bd3-f353-4b05-a9c9-1f8ddc59bc33","references":[{"source_name":"IBM Grandoreiro April 2020","description":"Abramov, D. (2020, April 13). Grandoreiro Malware Now Targeting Banks in Spain. Retrieved November 12, 2020.","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"}]},{"id":"S0568","name":"EVILNUM","url":"https://attack.mitre.org/software/S0568","kind":"malware","description":"[EVILNUM](https://attack.mitre.org/software/S0568) can harvest cookies and upload them to the C2 server.(Citation: Prevailion EvilNum May 2020)","relationship_id":"relationship--8785b9f9-52dd-4bf5-8e88-b80c4c28dc7f","references":[{"source_name":"Prevailion EvilNum May 2020","description":"Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) has used a script that extracts the web session cookie and sends it to the C2 server.(Citation: Cybereason Chaes Nov 2020) ","relationship_id":"relationship--8f6ffa28-0a5d-4adc-8789-17f3d83446a0","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) has the ability to capture web session cookies.(Citation: Kroll Qakbot June 2020)(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--7f92fc3c-044c-4095-be4b-f6482a5619d1","references":[{"source_name":"Kroll Qakbot June 2020","description":"Sette, N. et al. (2020, June 4). Qakbot Malware Now Exfiltrating Emails for Sophisticated Thread Hijacking Attacks. Retrieved September 27, 2021.","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--953091ba-9d00-41ba-8727-014f6d11b5d3","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) uses <code>scp</code> to access the <code>~/Library/Cookies/Cookies.binarycookies</code> file.(Citation: trendmicro xcsset xcode project 2020)","relationship_id":"relationship--acfadf9a-afa5-413e-8855-a96947c5ab26","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) attempts to steal Opera cookies, if present, after terminating the related process.(Citation: Rapid7 BlackBasta 2024)  ","relationship_id":"relationship--c54f50fe-017e-4015-8277-4d50f3ed0d97","references":[{"source_name":"Rapid7 BlackBasta 2024","description":"McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}]},{"id":"S1140","name":"Spica","url":"https://attack.mitre.org/software/S1140","kind":"malware","description":"[Spica](https://attack.mitre.org/software/S1140) has the ability to steal cookies from Chrome, Firefox, Opera, and Edge browsers.(Citation: Google TAG COLDRIVER January 2024)","relationship_id":"relationship--6608d133-27ba-4bd9-bcd4-5becca5a8018","references":[{"source_name":"Google TAG COLDRIVER January 2024","description":"Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes modules that can steal cookies from Firefox, Chrome, and Edge web browsers.(Citation: ESET EvasivePanda 2023)","relationship_id":"relationship--9ffa7daa-ce47-4333-87ac-e438b7556b0c","references":[{"source_name":"ESET EvasivePanda 2023","description":"Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) attempts to steal cookies and related information in browser history.(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--d8c19b7a-71a0-4941-9244-f9784e5e99fc","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"}]},{"id":"S1201","name":"TRANSLATEXT","url":"https://attack.mitre.org/software/S1201","kind":"malware","description":"[TRANSLATEXT](https://attack.mitre.org/software/S1201) has exfiltrated updated cookies from Google, Naver, Kakao or Daum to the C2 server.(Citation: Zscaler Kimsuky TRANSLATEXT) ","relationship_id":"relationship--8af30aa3-c5b7-4273-9de4-98fe5b2f4bf5","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can capture web session cookies and session information from victim browsers.(Citation: Google XLoader 2017)","relationship_id":"relationship--354cf266-b6f5-4ced-a704-65d1858212d4","references":[{"source_name":"Google XLoader 2017","description":"Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has harvested cookies from various browsers.(Citation: Cybereason LumaStealer Undated)(Citation: Fortinet LummaStealer 2024)(Citation: TrendMicro LummaStealer 2025)","relationship_id":"relationship--db995d8c-b561-4fdc-9c5b-a19b2383c058","references":[{"source_name":"TrendMicro LummaStealer 2025","description":"Buddy Tancio, Fe Cureg, and Jovit Samaniego, Trend Micro. (2025, January 30). Lumma Stealer’s GitHub-Based Delivery Explored via Managed Detection and Response. Retrieved March 22, 2025.","url":"https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html"},{"source_name":"Fortinet LummaStealer 2024","description":"Cara Lin, Fortinet. (2024, January 8). Deceptive Cracked Software Spreads Lumma Variant on YouTube. Retrieved March 22, 2025.","url":"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"},{"source_name":"Cybereason LumaStealer Undated","description":"Cybereaon Security Services Team. (n.d.). Your Data Is Under New Lummanagement: The Rise of LummaStealer. Retrieved March 22, 2025.","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) has stolen browser cookies and settings.(Citation: ESET RedLine Stealer November 2024)(Citation: Kroll RedLine Stealer August 2024)(Citation: Proofpoint RedLine Stealer March 2020)(Citation: Splunk RedLine Stealer June 2023)","relationship_id":"relationship--98847982-f5fe-4c8e-bd90-b24ba3ff58bd","references":[{"source_name":"ESET RedLine Stealer November 2024","description":"Alexandre Cote Cyr. (2024, November 8). Life on a crooked RedLine: Analyzing the infamous infostealer’s backend. Retrieved September 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"},{"source_name":"Kroll RedLine Stealer August 2024","description":"George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"},{"source_name":"Proofpoint RedLine Stealer March 2020","description":"Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"},{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}]},{"id":"S9003","name":"evilginx2","url":"https://attack.mitre.org/software/S9003","kind":"tool","description":"[evilginx2](https://attack.mitre.org/software/S9003) can collect information on each session with a victim including the session cookie.(Citation: Evilginx 2 July 2018)(Citation: Sophos Evilginx MAR 2025)\n","relationship_id":"relationship--4b5922d7-d1cf-4e5d-84c9-4e7e8ac4a6a5","references":[{"source_name":"Sophos Evilginx MAR 2025","description":"Everts, M. (2025, March 28). Stealing user credentials with evilginx. Retrieved January 27, 2026.","url":"https://www.sophos.com/en-us/blog/stealing-user-credentials-with-evilginx"},{"source_name":"Evilginx 2 July 2018","description":"Gretzky, K.. (2018, July 26). Evilginx 2 - Next Generation of Phishing 2FA Tokens. Retrieved October 14, 2019.","url":"https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has harvested Safari cookies stored within `/Library/Containers/com.apple.Safari/Data/Library/Cookies/ Cookies.binarycookies`.(Citation: Socket GlassWorm January 2026)  [GlassWorm](https://attack.mitre.org/software/S9010) has also stolen cookies within Chromium and Firefox browsers.(Citation: Koi Glassworm New Tricks December 2025)(Citation: Socket GlassWorm January 2026)","relationship_id":"relationship--42d78c28-8a26-4cac-88bb-93e35d5226e4","references":[{"source_name":"Koi Glassworm New Tricks December 2025","description":"Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"},{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can list the contents of `%LocalAppData%\\Google\\Chrome\\User Data\\` and `%LocalAppData%\\Microsoft\\Edge\\User Data\\` to obtain cookies.(Citation: ESET MirrorFace DEC 2022)","relationship_id":"relationship--ef10f1da-2388-4404-97aa-bcfa9bcd27ec","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"id":"S9044","name":"Kali365","url":"https://attack.mitre.org/software/S9044","kind":"malware","description":"[Kali365](https://attack.mitre.org/software/S9044) has captured session cookies and related session artifacts when the interacted phishing lure acts as proxy for legitimate requests with login services.(Citation: Artic Wolf Labs Kali365 Device Code April 2026)(Citation: SpyCloud Kali365 June 2026)","relationship_id":"relationship--4e4d727b-d8fe-412d-81d6-6028a4ea307c","references":[{"source_name":"Artic Wolf Labs Kali365 Device Code April 2026","description":"Artic Wolf Labs. (2026, April 24). Token Bingo: Don’t Let Your Code be the Winner. Retrieved July 30, 2026.","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"},{"source_name":"SpyCloud Kali365 June 2026","description":"Trevor Hilligoss. (2026, June 11). Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit – From Telegram Hype to FBI Takedown Theater. Retrieved July 30, 2026.","url":"https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has extracted session cookies.(Citation: Intrinsec_Vidar_April2026)(Citation: LevelBlue_Vidar_May2026)  ","relationship_id":"relationship--24b6a0ed-7c56-4dfa-be1b-97388f7a0bb1","references":[{"source_name":"Intrinsec_Vidar_April2026","description":"Intrinsec. (2026, April). \"Chaos is a ladder\": Vidar's recent rise to the top. Retrieved April 27, 2026.","url":"https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"},{"source_name":"LevelBlue_Vidar_May2026","description":"Joshi, M. (2026, May 7). Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication. Retrieved May 8, 2026.","url":"https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication"}]}],"actors":[{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has used publicly-available tools to steal cookies from browsers such as Chrome.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--5b252d63-e2a1-4ad3-aadd-96bc8dee78da","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) used information stealer malware to collect browser session cookies.(Citation: Leonard TAG 2023)","relationship_id":"relationship--1c61ec55-92dd-4bab-8a1d-fcadafc17dfe","references":[{"source_name":"Leonard TAG 2023","description":"Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024.","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used malware, such as [TRANSLATEXT](https://attack.mitre.org/software/S1201), to steal and exfiltrate browser cookies.(Citation: Zscaler Kimsuky TRANSLATEXT)(Citation: S2W Troll Stealer 2024) ","relationship_id":"relationship--15c72607-0bf4-4740-8754-2bb1547111bb","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Zscaler Kimsuky TRANSLATEXT","description":"Park, S. (2024, June 27). Kimsuky deploys TRANSLATEXT to target South Korean academia. Retrieved October 14, 2024.","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"id":"G0120","name":"Evilnum","url":"https://attack.mitre.org/groups/G0120","kind":"intrusion-set","description":"[Evilnum](https://attack.mitre.org/groups/G0120) can steal cookies and session information from browsers.(Citation: ESET EvilNum July 2020)","relationship_id":"relationship--3fd05c59-c28b-418a-be56-87ff52d4771c","references":[{"source_name":"ESET EvilNum July 2020","description":"Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"id":"G1014","name":"LuminousMoth","url":"https://attack.mitre.org/groups/G1014","kind":"intrusion-set","description":"[LuminousMoth](https://attack.mitre.org/groups/G1014) has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.(Citation: Kaspersky LuminousMoth July 2021)","relationship_id":"relationship--002f1039-f4c5-4c60-b8ac-ced374bec2ac","references":[{"source_name":"Kaspersky LuminousMoth July 2021","description":"Lechtik, M, and etl. (2021, July 14). LuminousMoth APT: Sweeping attacks for the chosen few. Retrieved October 20, 2022.","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) retrieves browser cookies via Raccoon Stealer.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--35b7c6d7-521c-41f6-81fc-af2f67d8ad82","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1033","name":"Star Blizzard","url":"https://attack.mitre.org/groups/G1033","kind":"intrusion-set","description":"[Star Blizzard](https://attack.mitre.org/groups/G1033) has used EvilGinx to steal the session cookies of victims directed to\n phishing domains.(Citation: CISA Star Blizzard Advisory December 2023)","relationship_id":"relationship--55409bd6-f45c-479c-9557-d8efff292789","references":[{"source_name":"CISA Star Blizzard Advisory December 2023","description":"CISA, et al. (2023, December 7). Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns. Retrieved June 13, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"}]},{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has used custom malware to steal login and cookie data from common browsers.(Citation: Mandiant APT42-charms) ","relationship_id":"relationship--e1062063-0f27-443e-9d6f-2dee44ee79aa","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]}],"mitigations":[{"id":"M1017","name":"User Training","url":"https://attack.mitre.org/mitigations/M1017","kind":"course-of-action","description":"Train users to identify aspects of phishing attempts where they're asked to enter credentials into a site that has the incorrect domain for the application they are logging into. Additionally, train users not to run untrusted JavaScript in their browser, such as by copying and pasting code or dragging and dropping bookmarklets.","relationship_id":"relationship--f780f9d8-1baa-41b7-b7a1-acba717df0ab","references":[]},{"id":"M1021","name":"Restrict Web-Based Content","url":"https://attack.mitre.org/mitigations/M1021","kind":"course-of-action","description":"Restrict or block web-based content that could be used to extract session cookies or credentials stored in browsers. Use browser security settings, such as disabling third-party cookies and restricting browser extensions, to limit the attack surface.","relationship_id":"relationship--44c91929-3473-443c-91be-5afa81582dfa","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Deploy hardware-based token (e.g., YubiKey or FIDO key), which incorporates the target login domain as part of the negotiation protocol, will prevent session cookie theft through proxy methods.\n\nImplement Conditional Access policies to only allow logins from trusted devices, such as those enrolled in Intune or joined via Hybrid/Entra. This mitigates the risk of session cookie replay attacks by ensuring that stolen tokens cannot be reused on unauthorized devices.","relationship_id":"relationship--7a1cf82e-68e5-49ca-89ae-e492cd85dab4","references":[]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Implement auditing for authentication activities and user logins to detect the use of stolen session cookies. Monitor for impossible travel scenarios and anomalous behavior that could indicate the use of compromised session tokens or cookies.","relationship_id":"relationship--1a5bf948-33fd-4025-aadd-117e99512e6a","references":[]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies.","relationship_id":"relationship--a27be16a-0132-4895-8f62-2bcc31cf15d7","references":[]},{"id":"M1054","name":"Software Configuration","url":"https://attack.mitre.org/mitigations/M1054","kind":"course-of-action","description":"Configure browsers or tasks to regularly delete persistent cookies.\n\nAdditionally, minimize the length of time a web cookie is viable to potentially reduce the impact of stolen cookies while also increasing the needed frequency of cookie theft attempts – providing defenders with additional chances at detection.(Citation: Token tactics) For example, use non-persistent cookies to limit the duration a session ID will remain on the web client cache where an attacker could obtain it.(Citation: Session Management Cheat Sheet)","relationship_id":"relationship--248a0d72-d9cd-43d3-985f-a33a49a79e8b","references":[{"source_name":"Token tactics","description":"Microsoft Incident Response. (2022, November 16). Token tactics: How to prevent, detect, and respond to cloud token theft. Retrieved December 26, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/"},{"source_name":"Session Management Cheat Sheet","description":"OWASP CheatSheets Series Team. (n.d.). Session Management Cheat Sheet. Retrieved December 26, 2023.","url":"https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"}]}],"candidates":[{"id":"26a6b840-4943-4965-8df5-ef1f9a282440","name":"Steal Chrome Cookies (Windows)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1539/T1539.yaml","description":"This test queries Chrome's SQLite database to steal the encrypted cookie data, designed to function similarly to Zloader/Zbot's cookie theft function. \nOnce an adversary obtains the encrypted cookie info, they could go on to decrypt the encrypted value, potentially allowing for session theft. \nNote: If Chrome is running, the process will be killed to ensure that the DB file isn't locked. \nSee https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf. \n","inputs":{"cookie_db":{"description":"Filepath for Chrome cookies database","type":"string","default":"$env:localappdata\\Google\\Chrome\\User Data\\Default\\Network\\Cookies"},"sqlite3_path":{"description":"Path to sqlite3","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\sqlite-tools-win32-x86-3380200\\sqlite3.exe"},"output_file":{"description":"Filepath to output cookies","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1539ChromeCookies.txt"}},"dependencies":[{"description":"Sqlite3 must exist at (#{sqlite3_path})\n"}],"source_definition_sha256":"3a8489dba331fc68c29fc65675eee8673038b6c2818983464ee0b541d56e8172"},{"id":"4b437357-f4e9-4c84-9fa6-9bcee6f826aa","name":"Steal Firefox Cookies (Windows)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1539/T1539.yaml","description":"This test queries Firefox's cookies.sqlite database to steal the cookie data contained within it, similar to Zloader/Zbot's cookie theft function. \nNote: If Firefox is running, the process will be killed to ensure that the DB file isn't locked. \nSee https://www.malwarebytes.com/resources/files/2020/05/the-silent-night-zloader-zbot_final.pdf. \n","inputs":{"sqlite3_path":{"description":"Path to sqlite3","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\sqlite-tools-win32-x86-3380200\\sqlite3.exe"},"output_file":{"description":"Filepath to output cookies","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1539FirefoxCookies.txt"}},"dependencies":[{"description":"Sqlite3 must exist at (#{sqlite3_path})\n"}],"source_definition_sha256":"cb6b4fbf8a7f9d2dd6339ff3c0e05933ab64f94744038149da50b6f7a97cd128"},{"id":"b647f4ee-88de-40ac-9419-f17fac9489a7","name":"Steal Chrome v127+ cookies via Remote Debugging (Windows)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1539/T1539.yaml","description":"Chrome v127+ uses app-bound encryption to protect cookies. This test bypasses that protection to obtain the cookies. If successful, the test outputs cookie values to the console.\nNote: Will stop any instances of Chrome already running\nAdapted from https://embracethered.com/blog/posts/2024/cookie-theft-in-2024-and-what-todo","inputs":{},"dependencies":[],"source_definition_sha256":"57554b2f2482201a2299dbff4ecb0e1361b1ff3af3819d6b1bcf825329e16039"},{"id":"e43cfdaf-3fb8-4a45-8de0-7eee8741d072","name":"Steal Chrome Cookies via Remote Debugging (Mac)","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1539/T1539.yaml","description":"The remote debugging functionality in Chrome can be used by malware for post-exploitation activities to obtain cookies without requiring keychain access. By initiating Chrome with a remote debug port, an attacker can sidestep encryption and employ Chrome's own mechanisms to access cookies.\n\nIf successful, this test will output a list of cookies.\n\nNote: Chrome processes will be killed during this test.\n\nSee https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e","inputs":{},"dependencies":[{"description":"Install Go"},{"description":"Download and compile WhiteChocolateMacademiaNut"}],"source_definition_sha256":"2082151c364e9d000fdcd6558fdee30e8e2bcd7eb3d4ab63bffe7442524c2222"},{"id":"e57ba07b-3a33-40cd-a892-748273b9b49a","name":"Copy Safari BinaryCookies files using AppleScript","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1539/T1539.yaml","description":"This command will copy Safari BinaryCookies files using AppleScript as seen in Atomic Stealer.\n","inputs":{"destination_path":{"description":"Specify the path to copy the BinaryCookies file into.","type":"path","default":"/private/tmp"}},"dependencies":[],"source_definition_sha256":"622da44aab8a669f8555bd991c112472db72958b01ebaf5d16f0319ffe2d6d02"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1204":"/ttp-simulation/techniques/enterprise/T1204/","T1557":"/ttp-simulation/techniques/enterprise/T1557/","T1550.004":"/ttp-simulation/techniques/enterprise/T1550.004/","T1539":"/ttp-simulation/techniques/enterprise/T1539/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1539","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}