Stolen Web Session Cookies: Detection and Defense (T1550.004)

Web Session Cookie is a lateral movement technique, tracked by MITRE as T1550.004. It applies to IaaS, Office Suite and SaaS platforms.

The core idea is simple. A session cookie proves a user already authenticated. If an adversary gets that cookie, some multi-factor authentication protections never come into play, because the session is already past them.

How attackers use it

Web applications, including cloud services, issue authentication cookies after login so credentials are not passed again and re-authentication is rare. MITRE notes these cookies are often valid for a long time, even when the application is not in use.

After obtaining a cookie through Steal Web Session Cookie or Web Cookies, the adversary imports it into a browser they control. They can then use the site as the user for as long as the session cookie stays active: reading email, reaching sensitive information, or doing anything the account is allowed to do. MITRE adds that malware has targeted session cookies to bypass multi-factor authentication.

How to detect it

MITRE's detection strategy looks for sessions that do not fit the user.

• Access to cloud web apps with session tokens but without matching MFA or credential validation, often from unusual locations or device fingerprints.
• Cookie reuse on unmanaged browsers, devices or client types that differ from the user baseline, for example a switch from Chrome to curl.
• Web session tokens reused in native Office apps such as Outlook or Teams without token refresh or login activity on the endpoint.

How to reduce the risk

MITRE lists one mitigation under Software Configuration: configure browsers or tasks to regularly delete persistent cookies. That shortens the window in which a stolen cookie is useful.

Quick check

Sources

• MITRE ATT&CK, Use Alternate Authentication Material: Web Session Cookie: https://attack.mitre.org/techniques/T1550/004