tfMITRE ATT&CK sub-technique

Web Cookies T1606.001

sub-technique of T1606 Forge Web Credentials

Tactic: Credential Access
Platforms: Linux, macOS, Windows, SaaS, IaaS
Version: 1.1
Created: 17 December 2020
Last modified: 24 October 2025
Contributor: Jack Burns, HubSpot

Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Web Cookies MITRE reference T1606.001

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SolarWinds CompromiseC0024 ↗

During the SolarWinds Compromise, APT29 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.1

2019–2021

All 1 campaigns for this technique

Offense vs defense T1606.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Web Cookies detection strategy DET0171

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Forged Web Cookies

Enterprise

5 platforms

AN0483 · IaaS

Forged cookies in IaaS environments may appear as authentication attempts that bypass MFA, leveraging AssumeRole or session APIs with cookies that were never legitimately issued. Defenders should correlate cloud logs for cookie-based sessions without prior valid authentication, often followed by resource access from unfamiliar IP addresses.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	AWS:CloudTrail	GetSessionToken, AssumeRoleWithWebIdentity
Logon Session CreationDC0067	AWS:CloudTrail	Web console logins using session cookies without corresponding MFA event

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
GeoVelocityThreshold	Flag logins from geographically distant locations in a short timeframe.
AuthorizedCookieIssuers	Expected systems and services that may legitimately mint session cookies.

AN0484 · Windows

Forged web cookies on Windows endpoints can be detected by monitoring unusual modifications of browser cookie stores (e.g., Chrome SQLite DB, Edge cache) by processes outside of browsers, followed by authentication events to SaaS or IaaS services. Defenders may observe processes writing directly to cookie storage paths or injecting tokens into browser sessions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BrowserCookiePaths	List of monitored cookie file paths on Windows systems.
ProcessWhitelist	Approved processes allowed to write to browser cookie stores.

AN0485 · Linux

On Linux, defenders may observe forged cookie activity as unauthorized modifications to browser cookie databases (e.g., ~/.mozilla/firefox/*/cookies.sqlite, ~/.config/chromium/Default/Cookies) or scripted injection of session tokens. Suspicious usage includes curl/wget commands embedding forged cookies in headers, correlated with abnormal session activity in SaaS or IaaS logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	auditd:SYSCALL	Unusual processes accessing or modifying cookie databases
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CredentialFilePaths	Paths to cookie/session storage files to monitor.

AN0486 · macOS

Forged cookies on macOS may show up as abnormal access to Safari/Chrome cookie databases in ~/Library/Cookies, combined with unexpected logon sessions authenticated by those cookies. Unified Logs may show cookie injection events or abnormal access patterns to Keychain when linked to browser authentication flows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	macos:unifiedlog	New session initiated using cookies without normal MFA or password validation
File AccessDC0055	macos:unifiedlog	Abnormal process access to Safari or Chrome cookie storage

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthorizedKeychainApps	Applications permitted to use Keychain to generate cookies or tokens.

AN0487 · SaaS

Forged cookies in SaaS environments manifest as valid web sessions without matching login activity, MFA enforcement bypass, or cookies reused across multiple devices/IPs. Defenders should look for cookie replay, concurrent sessions from multiple geographies, or session tokens generated by unrecognized apps.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Web Credential UsageDC0007	m365:unified	Session activity without correlated login event
Logon Session CreationDC0067	saas:access	Multiple concurrent logins using same cookie from different locations

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TokenReplayThreshold	Number of concurrent uses of a cookie that should trigger an alert.
GeoLocationAlerts	Unusual SaaS logins from geographically distant locations in short timeframes.

Web Cookies detections T1606.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs