Techniques › T1606.001 › AN0484
AN0484 Analytic 0484
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Forged web cookies on Windows endpoints can be detected by monitoring unusual modifications of browser cookie stores (e.g., Chrome SQLite DB, Edge cache) by processes outside of browsers, followed by authentication events to SaaS or IaaS services. Defenders may observe processes writing directly to cookie storage paths or injecting tokens into browser sessions.</p>
- Detects
- T1606.001 Web Cookies
- Part of
- DET0171 Detection Strategy for Forged Web Cookies
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Security | EventCode=4624, 4648 | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BrowserCookiePaths | List of monitored cookie file paths on Windows systems. |
ProcessWhitelist | Approved processes allowed to write to browser cookie stores. |