kevmap

TechniquesT1550.004 › AN0203

AN0203 Analytic 0203

Office Suite · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Web session tokens reused in native Office apps (e.g., Outlook, Teams) without associated token refresh or login behavior on the endpoint.</p>
Detects
T1550.004 Web Session Cookie
Part of
DET0074 Detect Use of Stolen Web Session Cookies Across Platforms

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
m365:unifiedUserLoggedInDC0067 Logon Session Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
EndpointTokenSyncGapAllowed delta between endpoint login and cloud token reuse