T1539 — Steal Web Session Cookie

Tactic: Credential Access · Platforms: Linux, macOS, Office Suite, SaaS, Windows

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has…

Sigma detection rules (5)

title: T1539 Steal Web Session Cookie
id: d306d683-a460-4ff6-9aa9-2f8fae9ff6f5
description: 'Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts. (Retargeted from the original process_creation label to process_access — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: TargetProcessList, AccessToolList, TargetCookiePaths.'
references:
  - https://attack.mitre.org/techniques/T1539
author: Shahrukh Khan
date: 2026-01-30
license: MIT
tags:
  - attack.credential-access
  - attack.t1539

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    TargetImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1FFFFF'

  filter_avedr:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\CSFalconService.exe'

  condition: selection and not filter_avedr

falsepositives:
  - Legitimate AV/EDR or password-manager browser-integration agents accessing the browser process; validate SourceImage.

level: high

title: T1539 Steal Web Session Cookie
id: b04e8ff3-7c4b-4b9f-8118-8e941bbc9275
description: 'Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Split into per-browser selections: Firefox stores cookies in a SQLite file named cookies.sqlite, while Chrome/Chromium store cookies in a file literally named Cookies (no extension) -- the prior single combined condition could never match the Chrome path since it required both fragments on a filename ending in cookies.sqlite. Tune using: CookieFilePatterns, TimeWindow, BrowserProcPatterns.'
references:
  - https://attack.mitre.org/techniques/T1539
author: Shahrukh Khan
date: 2026-04-01
license: MIT
tags:
  - attack.credential-access
  - attack.t1539

logsource:
  category: file_event
  product: linux

detection:
  selection_firefox:
    type: PATH
    name|contains: '.mozilla/firefox/'
    name|endswith: 'cookies.sqlite'
  selection_chrome:
    type: PATH
    name|contains:
      - '.config/google-chrome/'
      - '.config/chromium/'
    name|endswith: '/Cookies'
  condition: 1 of selection_*

falsepositives:
  - Legitimate browser-profile backup/sync tools reading the same cookie database/file; scope BrowserProcPatterns to exclude the browser's own process reading its own file.
  - Browser sync or profile-migration utilities that copy the Cookies/cookies.sqlite file during account setup.

level: high

title: T1539 Steal Web Session Cookie
id: 8892f221-bbaf-40c7-9bda-784cf997afa6
description: 'Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetBrowserList, BrowserCookiePathList.'
references:
  - https://attack.mitre.org/techniques/T1539
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.credential-access
  - attack.t1539

logsource:
  product: macos

detection:
  selection:
    SourceImage|endswith:
      - '/python3'
      - '/osascript'
  selection_target:
    TargetImage|contains:
      - 'Google Chrome'
      - 'Safari'
      - 'Firefox'
      - 'Microsoft Edge'
  condition: selection and selection_target

falsepositives:
  - Browser extension managers and password manager helper processes legitimately access the same cookie stores, so this should be scoped to unsigned or unexpected processes that are not the browser vendor or a recognized password manager.

level: high

title: T1539 Steal Web Session Cookie
id: 73ba4240-c752-46e0-b8f8-d486ac943ed4
description: 'Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: TokenReuseTimeWindow, UserAgentAnomalyScore, GeoLocationAnomalyScore.'
references:
  - https://attack.mitre.org/techniques/T1539
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.credential-access
  - attack.t1539

logsource:
  product: saas
  service: googleworkspace

detection:
  selection:
    events.name: 'suspicious_login'

  condition: selection

falsepositives:
  - Legitimate travel or first-time use of a new device or browser that Google Workspace has not yet learned as a trusted client.

level: high

title: T1539 Steal Web Session Cookie
id: b97172ec-c49b-4463-bec4-facec82a63f7
description: 'Detects creation or overwrite of a browser''s cookie store file (Chrome/Edge/Brave Network\Cookies, Firefox cookies.sqlite) by a process other than the owning browser, consistent with copying the cookie database to steal web session cookies per T1539. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: BrowserProcessAllowlist, CookiePathList.'
references:
  - https://attack.mitre.org/techniques/T1539
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.credential-access
  - attack.t1539

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
      - '\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith:
      - '\Network\Cookies'
      - 'cookies.sqlite'
  filter_browser_self_write:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection and not filter_browser_self_write

falsepositives:
  - Browser profile migration/sync tools or backup software copying the cookie store as part of a legitimate profile backup.

level: medium

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1539 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan