T1550.004 — Web Session Cookie

Tactic: Lateral Movement · Platforms: IaaS, Office Suite, SaaS

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated. Authentication cookies are commonly used in web applications, including cloud-based services,…

Sub-technique of Use Alternate Authentication Material (T1550).

Sigma detection rules (3)

T1550.004 Use Alternate Authentication Material: Web Session Cookie

title: "T1550.004 Use Alternate Authentication Material: Web Session Cookie"
id: 1afca82b-3af3-4642-9050-5fcc45d568cc
description: 'Detect Use of Stolen Web Session Cookies Across Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, IPGeolocationDistance.'
references:
  - https://attack.mitre.org/techniques/T1550/004
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName: 'ConsoleLogin'
    additionalEventData.MFAUsed: 'No'

  condition: selection

falsepositives:
  - Break-glass or legacy IAM users intentionally excluded from MFA enforcement; genuine geo-velocity confirmation of session-cookie reuse would need historical IP baselining that a single CloudTrail event cannot provide.

level: high

T1550.004 Use Alternate Authentication Material: Web Session Cookie

title: "T1550.004 Use Alternate Authentication Material: Web Session Cookie"
id: 0b276111-2a25-4b7f-a55d-f5ad95b3e3d4
description: 'Detect Use of Stolen Web Session Cookies Across Platforms. (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: BrowserFingerprintMatch, SessionReuseTimeout.'
references:
  - https://attack.mitre.org/techniques/T1550/004
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.004

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'UserLoggedIn'
  filter_singleip:
    ClientIP|cidr: '10.0.0.0/8'
  condition: selection and not filter_singleip

falsepositives:
  - Legitimate use of corporate VPN egress points that cause multiple users to appear from the same external IP, or mobile carriers with shared NAT pools; browser fingerprint fields are not natively present in the unified audit log.

level: low

T1550.004 Use Alternate Authentication Material: Web Session Cookie

title: "T1550.004 Use Alternate Authentication Material: Web Session Cookie"
id: f8239a20-ea0f-413d-b4a1-d433e8681119
description: 'Detect Use of Stolen Web Session Cookies Across Platforms. (Data Component: Logon Session Creation; baseline tier: fallback.) Tune using: EndpointTokenSyncGap.'
references:
  - https://attack.mitre.org/techniques/T1550/004
author: Shahrukh Khan
date: 2026-05-09
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.004

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'UserLoggedIn'
  selection_multi:
    Workload:
      - 'Exchange'
      - 'SharePoint'
      - 'AzureActiveDirectory'
  condition: selection and selection_multi

falsepositives:
  - Normal cross-workload single-sign-on activity where one authentication naturally spans multiple M365 services; token synchronization gaps between endpoints are not directly measurable from this log alone.

level: low

Related sub-techniques

Explore