tfMITRE ATT&CK technique

Browser Session Hijacking T1185

Tactic: Collection
Platform: Windows
Version: 2.1
Created: 16 January 2018
Last modified: 12 May 2026
Contributor: Justin Warner, ICEBRG

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 21%

Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Browser Session Hijacking MITRE reference T1185

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

KimsukyG0094 ↗

Has the ability to use form-grabbing to extract emails and passwords from web data forms.1

created 2019-08-261 referenceaka Black Banshee

All 1 groups for this technique

Offense vs defense T1185

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 9

first rule: 2022 Q3

Browser Session Hijacking detection strategy DET0507

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect browser session hijacking via privilege, handle access, and remote thread into browsers

Enterprise

1 platform

AN1398 · Windows

Adversary gains high integrity or special privileges (e.g., SeDebugPrivilege), locates a running browser process, opens it with write/inject rights, and modifies it (e.g., CreateRemoteThread / DLL load) to inherit cookies/tokens or establish a browser pivot. Optional step: create a new logon session or use explicit credentials, then drive the victim browser to intranet resources.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	WinEventLog:Security	EventCode=4673
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process ModificationDC0020	WinEventLog:Sysmon	EventCode=8
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BrowserList	Set of monitored browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe). Adjust per fleet.
AccessMaskSet	Access rights implying injection (e.g., 0x1FFFFF, 0x1F3FF, VM_WRITE, VM_OPERATION, CREATE_THREAD). Tune by EDR mapping.
SignerAllowList	Allowed module signers within browser processes (e.g., Microsoft, Google). Helps flag unsigned/unknown ImageLoad into browsers.
InternalCIDR	Enterprise internal ranges or DNS suffixes to identify intranet pivoting via the browser.
TimeWindow	Correlation interval (e.g., 10–20 minutes) linking privilege gain → access → modification → network usage.
ParentAllowList	Legitimate tools that may automate browsers (e.g., Selenium drivers). Reduce FPs by allowlisting.
UserContext	Scope analytics to high-value users, admin workstations, or servers where browsers shouldn’t be automated.

Browser Session Hijacking detections T1185

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs