MITRE ATT&CKtechnique

T1185 Browser Session Hijacking

Published 2018-01-16 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Windows
Version
2.1
Created
2018-01-16

Description

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques. A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet. Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights. Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic. This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed. The adversary assumes the security context of whichever browser process the proxy is injected into. Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly. With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions. Browser pivoting may also bypass security provided by 2-factor authentication.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1017 User Training mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (16)

  • S9044 Kali365 software (malware)
  • S9003 evilginx2 software (tool)
  • S1207 XLoader software (malware)
  • S1201 TRANSLATEXT software (malware)
  • S0650 QakBot software (malware)
  • S0631 Chaes software (malware)
  • S0530 Melcoz software (malware)
  • S0531 Grandoreiro software (malware)
  • S0483 IcedID software (malware)
  • S0484 Carberp software (malware)
  • G0094 Kimsuky group
  • S0386 Ursnif software (malware)
  • S0384 Dridex software (malware)
  • S0331 Agent Tesla software (malware)
  • S0266 TrickBot software (malware)
  • S0154 Cobalt Strike software (malware)

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-593 Session Hijacking attack pattern
  • CAPEC-662 Adversary in the Browser (AiTB) attack pattern

Referenced by Compliance · mitigates (15)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-10 Concurrent Session Control NIST 800-53 control
  • NIST-AC-12 Session Termination NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References