tfMITRE ATT&CK sub-technique

Web Session Cookie T1550.004

sub-technique of T1550 Use Alternate Authentication Material

Tactic: Lateral Movement
Platforms: IaaS, Office Suite, SaaS
Version: 2.0
Created: 30 January 2020
Last modified: 12 May 2026
Contributors: Jack Burns, HubSpot; Johann Rehberger

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Web Session Cookie MITRE reference T1550.004

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Star BlizzardG1033 ↗

Has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.1

created 2024-06-141 referenceaka SEABORGIUM

All 1 groups for this technique

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged duo-sid cookie to bypass MFA set on an email account.1 2

2019–2021

All 1 campaigns for this technique

Offense vs defense T1550.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2023 Q2 · 1 of 1 campaigns plotted

Web Session Cookie detection strategy DET0074

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Use of Stolen Web Session Cookies Across Platforms

Enterprise

3 platforms

AN0201 · IaaS

Anomalous access to cloud web applications using session tokens without corresponding MFA/credential validation, often from unusual locations or device fingerprints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	AWS:CloudTrail	SessionToken used without preceding MFA or login event
Logon Session CreationDC0067	AWS:CloudTrail	ConsoleLogin

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	How far back to check for legitimate MFA or login events before token usage
IPGeolocationDistance	Threshold for flagging geographically impossible logins

AN0202 · SaaS

Session cookie reuse on unmanaged browsers, devices, or client types deviating from user baseline (e.g., switching from Chrome to curl).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	saas:okta	session.impersonation.start
Web Credential UsageDC0007	m365:unified	SessionId reused from different device/browser fingerprint

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BrowserFingerprintMatch	Tolerance for accepting small differences in user-agent headers
SessionReuseTimeout	Time gap threshold between valid session creation and reuse

AN0203 · Office Suite

Web session tokens reused in native Office apps (e.g., Outlook, Teams) without associated token refresh or login behavior on the endpoint.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Logon Session CreationDC0067	m365:unified	UserLoggedIn

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EndpointTokenSyncGap	Allowed delta between endpoint login and cloud token reuse

Web Session Cookie detections T1550.004

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs