T1185 — Browser Session Hijacking

Tactic: Collection · Platforms: Windows

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a…

Sigma detection rules (1)

T1185 Browser Session Hijacking

title: T1185 Browser Session Hijacking
id: fb705fbc-4756-484f-911c-7501c636b0cd
description: 'Detects a process obtaining a highly privileged handle (memory-write/thread-creation access rights) into a running browser process. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: BrowserList, AccessMaskSet, SignerAllowList, InternalCIDR, TimeWindow, ParentAllowList.'
references:
  - https://attack.mitre.org/techniques/T1185
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.collection
  - attack.t1185

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 10
    TargetImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
  selection_access:
    GrantedAccess:
      - '0x1F3FFF'
      - '0x1FFFFF'
      - '0x1F0FFF'
      - '0x1F2FFF'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_access and not filter_system_account

falsepositives:
  - Endpoint security/AV products and password managers with legitimate browser-integration handle access.

level: medium

Explore