Techniques › T1185 › AN1398
AN1398 Analytic 1398
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary gains high integrity or special privileges (e.g., SeDebugPrivilege), locates a running browser process, opens it with write/inject rights, and modifies it (e.g., CreateRemoteThread / DLL load) to inherit cookies/tokens or establish a browser pivot. Optional step: create a new logon session or use explicit credentials, then drive the victim browser to intranet resources.</p>
- Detects
- T1185 Browser Session Hijacking
- Part of
- DET0507 Detect browser session hijacking via privilege, handle access, and remote thread into browsers
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4672 | DC0088 Logon Session Metadata |
| WinEventLog:Security | EventCode=4673 | DC0013 User Account Metadata |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Sysmon | EventCode=8 | DC0020 Process Modification |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BrowserList | Set of monitored browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe). Adjust per fleet. |
AccessMaskSet | Access rights implying injection (e.g., 0x1FFFFF, 0x1F3FF, VM_WRITE, VM_OPERATION, CREATE_THREAD). Tune by EDR mapping. |
SignerAllowList | Allowed module signers within browser processes (e.g., Microsoft, Google). Helps flag unsigned/unknown ImageLoad into browsers. |
InternalCIDR | Enterprise internal ranges or DNS suffixes to identify intranet pivoting via the browser. |
TimeWindow | Correlation interval (e.g., 10–20 minutes) linking privilege gain → access → modification → network usage. |
ParentAllowList | Legitimate tools that may automate browsers (e.g., Selenium drivers). Reduce FPs by allowlisting. |
UserContext | Scope analytics to high-value users, admin workstations, or servers where browsers shouldn’t be automated. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2012-0767 | Adobe Flash Player | Mapped |
| CVE-2022-24682 | Synacor Zimbra Collaborate Suite (ZCS) | Mapped |
| CVE-2023-34192 | Synacor Zimbra Collaboration Suite (ZCS) | Mapped |