{"id":"T1539","name":"Steal Web Session Cookie","url":"https://attack.mitre.org/techniques/T1539","tactics":["credential-access"],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0509","stix_id":"x-mitre-detection-strategy--26fdbcb2-abc1-4844-8e5d-2c6039336cb7","name":"Detection of Web Session Cookie Theft via File, Memory, and Network Artifacts","url":"https://attack.mitre.org/detectionstrategies/DET0509","analytics":[{"id":"AN1402","stix_id":"x-mitre-analytic--dd105985-5d61-43f0-b69b-b4fd52632257","name":"Analytic 1402","description":"Detects suspicious access to browser session cookie storage (e.g., Chrome’s `Cookies` SQLite DB) or memory reads of browser processes. Anomalous injection or memory dump utilities targeting browser processes such as `chrome.exe`, `firefox.exe`, or `msedge.exe`.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1402","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=2","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TargetProcessList","description":"Monitored browsers (e.g., chrome.exe, firefox.exe)"},{"field":"AccessToolList","description":"Suspicious tools used for injection or memory access (e.g., mimikatz, procdump)"},{"field":"TargetCookiePaths","description":"Locations of cookie stores like `AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies`"}],"live":true,"detection_strategies":["DET0509"],"techniques":["T1539"]},{"id":"AN1403","stix_id":"x-mitre-analytic--9bcedfe7-c851-418a-b709-dd8883c7fc5e","name":"Analytic 1403","description":"Detects access to known browser cookie files (e.g., `~/.mozilla/firefox/*.default/cookies.sqlite`, `~/.config/google-chrome/`) and suspicious reads of browser memory via `/proc/[pid]/mem` or ptrace.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1403","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open or read to browser cookie storage","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"ptrace syscall or access to /proc/*/mem","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"CookieFilePatterns","description":"Regex paths to known browser cookie locations"},{"field":"TimeWindow","description":"Correlated time range between cookie read and web upload or process injection"},{"field":"BrowserProcPatterns","description":"Expected names for browser processes being accessed"}],"live":true,"detection_strategies":["DET0509"],"techniques":["T1539"]},{"id":"AN1404","stix_id":"x-mitre-analytic--3fdd7ef4-b382-4880-9f72-bf0ad696af85","name":"Analytic 1404","description":"Detects unauthorized access to browser cookie paths (e.g., `~/Library/Application Support/Google/Chrome/Default/Cookies`) or `task_for_pid`/`vm_read` calls to Safari/Chrome memory space.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1404","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"vm_read, task_for_pid, or file open to cookie databases","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"file open for known browser cookie paths","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"TargetBrowserList","description":"List of processes considered web browsers on macOS"},{"field":"BrowserCookiePathList","description":"Cookie database paths specific to each browser"}],"live":true,"detection_strategies":["DET0509"],"techniques":["T1539"]},{"id":"AN1405","stix_id":"x-mitre-analytic--916993bd-600a-43e2-abbf-30c56be84459","name":"Analytic 1405","description":"Detects automation macros or VBA scripts in documents that access browser file paths, read cookie data, or attempt to exfiltrate browser session tokens over HTTP.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1405","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"RunMacro","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"WinEventLog:Sysmon","channel":"EventCode=2","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MacroTargetPath","description":"Files or directories macros are attempting to access"},{"field":"HTTPDestinationIPList","description":"List of IPs or domains that are uncommon for macro-based HTTP POSTs"}],"live":true,"detection_strategies":["DET0509"],"techniques":["T1539"]},{"id":"AN1406","stix_id":"x-mitre-analytic--5e1d71ce-5653-4580-a609-9832c88e2c87","name":"Analytic 1406","description":"Detects use of session cookies or authentication tokens from unusual user agents or locations. Identifies token reuse without reauthentication or attempts to bypass MFA using previously stolen cookies.","url":"https://attack.mitre.org/detectionstrategies/DET0509#AN1406","platforms":["SaaS"],"log_source_references":[{"name":"saas:googleworkspace","channel":"login with reused session token and mismatched user agent or IP","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"saas-googleworkspace"},{"name":"saas:okta","channel":"session.token.reuse","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"saas-okta"}],"mutable_elements":[{"field":"TokenReuseTimeWindow","description":"Max allowed delta between token issuance and second use"},{"field":"UserAgentAnomalyScore","description":"Deviation score from normal browser/device fingerprint"},{"field":"GeoLocationAnomalyScore","description":"Deviation in IP region or ASN per user profile"}],"live":true,"detection_strategies":["DET0509"],"techniques":["T1539"]}],"live":true,"version":"1.0","techniques":["T1539"]}],"sigma_rules":[{"id":"24c77512-782b-448a-8950-eddb0785fc71","title":"SQLite Chromium Profile Data DB Access","author":"TropChaud","status":"test","level":"high","date":"2022-12-19","modified":"2023-01-19","description":"Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.","references":["https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1539","attack.t1555.003","attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml","techniques":["T1539","T1555.003","T1005"],"cves":[]},{"id":"4833155a-4053-4c9c-a997-777fcea0baa7","title":"SQLite Firefox Profile Data DB Access","author":"frack113","status":"test","level":"high","date":"2022-04-08","modified":"2023-01-19","description":"Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1539","attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml","techniques":["T1539","T1005"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}