T1606.001 — Web Cookies

Tactic: Credential Access · Platforms: Linux, macOS, Windows, SaaS, IaaS

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access. Adversaries may generate these…

Sub-technique of Forge Web Credentials (T1606).

Sigma detection rules (5)

title: "T1606.001 Forge Web Credentials: Web Cookies"
id: 88058348-84b7-4037-8ab6-bac177d4dc60
description: 'Detection Strategy for Forged Web Cookies. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: BrowserCookiePaths, ProcessWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1606/001
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'

  selection_chromium_cookie_store:
    TargetFilename|contains: '\User Data\'
    TargetFilename|endswith:
      - '\Network\Cookies'
      - '\Cookies'

  selection_firefox_cookie_store:
    TargetFilename|contains: '\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith: 'cookies.sqlite'

  filter_browser_process:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and (selection_chromium_cookie_store or selection_firefox_cookie_store) and not filter_browser_process and not filter_system_account

falsepositives:
  - Browser profile sync, migration, or backup tools that legitimately write to the cookie store outside the browser process.

level: medium

title: "T1606.001 Forge Web Credentials: Web Cookies"
id: e3543466-2046-4046-ae75-dbcdc32f5389
description: 'Detection Strategy for Forged Web Cookies. Forging a valid session cookie requires the browser''s local encryption key used to sign/encrypt cookies (e.g. Chromium''s Local State AES key); this rule watches for a non-browser process reading a browser process'' memory with a high-privilege access mask, the closest Windows-observable precursor to that key-extraction step, since the cookie-forging computation itself is offline and leaves no host artifact. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: CredentialFilePaths.'
references:
  - https://attack.mitre.org/techniques/T1606/001
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.001

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 10
    TargetImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\opera.exe'
      - '\brave.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1038'
      - '0x1400'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'

  filter_browser_source:
    SourceImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\opera.exe'
      - '\brave.exe'

  condition: selection and not filter_browser_source

falsepositives:
  - Endpoint security/password-manager/browser-sync tooling that legitimately reads browser process memory; tune with CredentialFilePaths.

level: high

title: "T1606.001 Forge Web Credentials: Web Cookies"
id: f20faabd-7c51-40cc-9f4d-ec097a3c57c3
description: 'Detection Strategy for Forged Web Cookies. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AuthorizedKeychainApps.'
references:
  - https://attack.mitre.org/techniques/T1606/001
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/sqlite3'
      - '/python3'
    CommandLine|contains: 'Cookies.binarycookies'

  condition: selection

falsepositives:
  - Browser migration or sync tools that read the cookie store as part of an approved profile transfer.

level: high

title: "T1606.001 Forge Web Credentials: Web Cookies"
id: 5a122bf5-9135-449b-af73-ab3d2dcb4e0a
description: 'Detection Strategy for Forged Web Cookies. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GeoVelocityThreshold, AuthorizedCookieIssuers.'
references:
  - https://attack.mitre.org/techniques/T1606/001
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName: 'ConsoleLogin'
    userIdentity.type: 'FederatedUser'
    additionalEventData.MFAUsed: 'No'

  condition: selection

falsepositives:
  - Standard SSO federated console access where MFA is enforced upstream at the identity provider rather than in AWS; CloudTrail cannot distinguish a legitimately issued session cookie from an injected or stolen one without correlating source IP history over time.

level: medium

title: "T1606.001 Forge Web Credentials: Web Cookies"
id: a4df5a0f-5f31-4f95-b9f6-7bc83e9485c5
description: 'Detection Strategy for Forged Web Cookies. (Data Component: Web Credential Usage; baseline tier: fallback.) Tune using: TokenReplayThreshold, GeoLocationAlerts.'
references:
  - https://attack.mitre.org/techniques/T1606/001
author: Shahrukh Khan
date: 2026-06-26
license: MIT
tags:
  - attack.credential-access
  - attack.t1606.001

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'UserLoggedIn'
  selection_multi:
    Workload:
      - 'Exchange'
      - 'SharePoint'
  condition: selection and selection_multi

falsepositives:
  - Legitimate single-sign-on sessions spanning Exchange and SharePoint in rapid succession as part of normal application switching; replay detection genuinely requires session token correlation outside this log.

level: medium

Related sub-techniques

• T1606.002 SAML Tokens

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1606.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan