MITRE ATT&CKtechnique

T1539 Steal Web Session Cookie

Published 2019-10-08 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Linux, macOS, Office Suite, SaaS, Windows
Version
1.5
Created
2019-10-08

Description

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols. There are several examples of malware targeting cookies from web browsers on the local system. Adversaries may also steal cookies by injecting malicious JavaScript content into websites or relying on User Execution by tricking victims into running malicious JavaScript in their browser. There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (e.g., Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns. After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.

Related

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (6)

  • M1054 Software Configuration mitigation
  • M1047 Audit mitigation
  • M1051 Update Software mitigation
  • M1032 Multi-factor Authentication mitigation
  • M1017 User Training mitigation
  • M1021 Restrict Web-Based Content mitigation

Referenced by MITRE ATT&CK · uses (30)

  • S9050 Vidar software (malware)
  • S9044 Kali365 software (malware)
  • S9020 LODEINFO software (malware)
  • S9010 GlassWorm software (malware)
  • S9003 evilginx2 software (tool)
  • S1240 RedLine Stealer software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1207 XLoader software (malware)
  • S1201 TRANSLATEXT software (malware)
  • G1044 APT42 group
  • S1148 Raccoon Stealer software (malware)
  • S1146 MgBot software (malware)
  • S1140 Spica software (malware)
  • G1033 Star Blizzard group
  • S1111 DarkGate software (malware)
  • G1015 Scattered Spider group
  • C0024 SolarWinds Compromise campaign
  • G1014 LuminousMoth group
  • S0658 XCSSET software (malware)
  • S0657 BLUELIGHT software (malware)
  • S0650 QakBot software (malware)
  • S0631 Chaes software (malware)
  • S0568 EVILNUM software (malware)
  • G0120 Evilnum group
  • S0531 Grandoreiro software (malware)
  • S0492 CookieMiner software (malware)
  • S0467 TajMahal software (malware)
  • G0094 Kimsuky group
  • G0030 Lotus Blossom group
  • G0034 Sandworm Team group

Referenced by CAPEC · att&ck technique (2)

  • CAPEC-21 Exploitation of Trusted Identifiers attack pattern
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies attack pattern

Referenced by Compliance · mitigates (17)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-18.3 Remediate Penetration Test Findings CIS Safeguard v8.1
  • CIS-4.11 Enforce Remote Wipe Capability on Portable End-User Devices CIS Safeguard v8.1
  • CIS-7.4 Perform Automated Application Patch Management CIS Safeguard v8.1
  • CIS-7.7 Remediate Detected Vulnerabilities CIS Safeguard v8.1
  • CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CIS Safeguard v8.1
  • CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions CIS Safeguard v8.1
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References