{"id":"T1606.001","name":"Web Cookies","url":"https://attack.mitre.org/techniques/T1606/001","tactics":["credential-access"],"platforms":["Linux","macOS","Windows","SaaS","IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0171","stix_id":"x-mitre-detection-strategy--e1854c9f-2b70-4311-9a46-a420f6c0b6d0","name":"Detection Strategy for Forged Web Cookies","url":"https://attack.mitre.org/detectionstrategies/DET0171","analytics":[{"id":"AN0483","stix_id":"x-mitre-analytic--9a6089cc-92a7-48ea-b4a4-4d4d2b6489e3","name":"Analytic 0483","description":"Forged cookies in IaaS environments may appear as authentication attempts that bypass MFA, leveraging AssumeRole or session APIs with cookies that were never legitimately issued. Defenders should correlate cloud logs for cookie-based sessions without prior valid authentication, often followed by resource access from unfamiliar IP addresses.","url":"https://attack.mitre.org/detectionstrategies/DET0171#AN0483","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"Web console logins using session cookies without corresponding MFA event","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"GetSessionToken, AssumeRoleWithWebIdentity","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"GeoVelocityThreshold","description":"Flag logins from geographically distant locations in a short timeframe."},{"field":"AuthorizedCookieIssuers","description":"Expected systems and services that may legitimately mint session cookies."}],"live":true,"detection_strategies":["DET0171"],"techniques":["T1606.001"]},{"id":"AN0484","stix_id":"x-mitre-analytic--305c684a-2b36-4209-9d00-778ed16de763","name":"Analytic 0484","description":"Forged web cookies on Windows endpoints can be detected by monitoring unusual modifications of browser cookie stores (e.g., Chrome SQLite DB, Edge cache) by processes outside of browsers, followed by authentication events to SaaS or IaaS services. Defenders may observe processes writing directly to cookie storage paths or injecting tokens into browser sessions.","url":"https://attack.mitre.org/detectionstrategies/DET0171#AN0484","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"BrowserCookiePaths","description":"List of monitored cookie file paths on Windows systems."},{"field":"ProcessWhitelist","description":"Approved processes allowed to write to browser cookie stores."}],"live":true,"detection_strategies":["DET0171"],"techniques":["T1606.001"]},{"id":"AN0485","stix_id":"x-mitre-analytic--7b981ab1-eb5f-4ad0-a819-90db819a4431","name":"Analytic 0485","description":"On Linux, defenders may observe forged cookie activity as unauthorized modifications to browser cookie databases (e.g., ~/.mozilla/firefox/*/cookies.sqlite, ~/.config/chromium/Default/Cookies) or scripted injection of session tokens. Suspicious usage includes curl/wget commands embedding forged cookies in headers, correlated with abnormal session activity in SaaS or IaaS logs.","url":"https://attack.mitre.org/detectionstrategies/DET0171#AN0485","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Unusual processes accessing or modifying cookie databases","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CredentialFilePaths","description":"Paths to cookie/session storage files to monitor."}],"live":true,"detection_strategies":["DET0171"],"techniques":["T1606.001"]},{"id":"AN0486","stix_id":"x-mitre-analytic--27a0146c-0af8-4323-9c41-fbd3df9af1fa","name":"Analytic 0486","description":"Forged cookies on macOS may show up as abnormal access to Safari/Chrome cookie databases in ~/Library/Cookies, combined with unexpected logon sessions authenticated by those cookies. Unified Logs may show cookie injection events or abnormal access patterns to Keychain when linked to browser authentication flows.","url":"https://attack.mitre.org/detectionstrategies/DET0171#AN0486","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Abnormal process access to Safari or Chrome cookie storage","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"New session initiated using cookies without normal MFA or password validation","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"AuthorizedKeychainApps","description":"Applications permitted to use Keychain to generate cookies or tokens."}],"live":true,"detection_strategies":["DET0171"],"techniques":["T1606.001"]},{"id":"AN0487","stix_id":"x-mitre-analytic--f8c255ac-8ba5-4971-9e11-420a10e688ad","name":"Analytic 0487","description":"Forged cookies in SaaS environments manifest as valid web sessions without matching login activity, MFA enforcement bypass, or cookies reused across multiple devices/IPs. Defenders should look for cookie replay, concurrent sessions from multiple geographies, or session tokens generated by unrecognized apps.","url":"https://attack.mitre.org/detectionstrategies/DET0171#AN0487","platforms":["SaaS"],"log_source_references":[{"name":"m365:unified","channel":"Session activity without correlated login event","data_component":"DC0007","data_component_name":"Web Credential Usage","log_source_slug":"m365-unified"},{"name":"saas:access","channel":"Multiple concurrent logins using same cookie from different locations","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"saas-access"}],"mutable_elements":[{"field":"TokenReplayThreshold","description":"Number of concurrent uses of a cookie that should trigger an alert."},{"field":"GeoLocationAlerts","description":"Unusual SaaS logins from geographically distant locations in short timeframes."}],"live":true,"detection_strategies":["DET0171"],"techniques":["T1606.001"]}],"live":true,"version":"1.0","techniques":["T1606.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}