T1539 Steal Web Session Cookie
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website. Cookies are often valid for an extended period of time, even if the web…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- SQLite Chromium Profile Data DB Accesshightest · windows
- SQLite Firefox Profile Data DB Accesshightest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.