1200KM / detection
T1539 Steal Web Session Cookie — Detection Rules
Detection workspace for T1539 Steal Web Session Cookie: 2 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- SQLite Chromium Profile Data DB Access · test · high · {"category":"process_creation","product":"windows"}
- SQLite Firefox Profile Data DB Access · test · high · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0509 Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts
AN1402 Analytic 1402
Detects suspicious access to browser session cookie storage (e.g., Chrome’s `Cookies` SQLite DB) or memory reads of browser processes. Anomalous injection or memory dump utilities targeting browser processes such as `chrome.exe`, `firefox.exe`, or `msedge.exe`.
AN1403 Analytic 1403
Detects access to known browser cookie files (e.g., `~/.mozilla/firefox/*.default/cookies.sqlite`, `~/.config/google-chrome/`) and suspicious reads of browser memory via `/proc/[pid]/mem` or ptrace.
AN1404 Analytic 1404
Detects unauthorized access to browser cookie paths (e.g., `~/Library/Application Support/Google/Chrome/Default/Cookies`) or `task_for_pid`/`vm_read` calls to Safari/Chrome memory space.
AN1405 Analytic 1405
Detects automation macros or VBA scripts in documents that access browser file paths, read cookie data, or attempt to exfiltrate browser session tokens over HTTP.
AN1406 Analytic 1406
Detects use of session cookies or authentication tokens from unusual user agents or locations. Identifies token reuse without reauthentication or attempts to bypass MFA using previously stolen cookies.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.