Techniques › T1606.001 › AN0483
AN0483 Analytic 0483
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Forged cookies in IaaS environments may appear as authentication attempts that bypass MFA, leveraging AssumeRole or session APIs with cookies that were never legitimately issued. Defenders should correlate cloud logs for cookie-based sessions without prior valid authentication, often followed by resource access from unfamiliar IP addresses.</p>
- Detects
- T1606.001 Web Cookies
- Part of
- DET0171 Detection Strategy for Forged Web Cookies
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | Web console logins using session cookies without corresponding MFA event | DC0067 Logon Session Creation |
| AWS:CloudTrail | GetSessionToken, AssumeRoleWithWebIdentity | DC0007 Web Credential Usage |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
GeoVelocityThreshold | Flag logins from geographically distant locations in a short timeframe. |
AuthorizedCookieIssuers | Expected systems and services that may legitimately mint session cookies. |