TA0005 · DEFENSE EVASION
Web Session Cookie
Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.
Detect it with
Monitor for anomalous access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.
Why it matters on shift
Web Session Cookie is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context