T1539 Steal Web Session Cookie — Detection & Response
An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Coverage at a glance
- Detections shipped
- 3
- Avg. verdict time
- < 5 min
- Data sources
- 2+
Threat context
How adversaries use T1539 Steal Web Session Cookie — Detection & Response
An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Session cookie theft is the mechanism behind AiTM (adversary-in-the-middle) phishing, where a reverse proxy sits between the user and the legitimate service, capturing both credentials and session cookies in real time. Tools like Evilginx2, Modlishka, and Muraena automate this. The stolen session cookie allows the attacker to authenticate as the user in subsequent requests without triggering MFA challenges since the session is already authenticated. This technique is why phishing-resistant MFA (passkeys/FIDO2) is the only reliable defence — it binds authentication to the legitimate origin.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| Session Token Replay from New IP — Active session accessed from different IP than auth An active session is being used from an IP address that differs from the IP used for authentication, consistent with stolen session token replay. | Critical | Okta / Entra ID |
| Impossible Travel on Session Access — Session used from location physically impossible since auth The authenticated session is accessed from a geographic location impossible to reach in the time since authentication. | Critical | Okta / Entra ID |
| Entra ID Stolen Session Risk Detection — Microsoft classifies sign-in as stolen session Microsoft Entra Identity Protection risk engine flags the sign-in as consistent with session token theft. | High | Entra ID Identity Protection |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1539 Steal Web Session Cookie — Detection & Response: frequently asked questions
If MFA was completed, how can a session cookie be stolen?
AiTM proxies sit between the user and the real site. The user completes MFA against the proxy (which forwards it to the real site), and the proxy receives the authenticated session cookie. The user sees the real site; the attacker has the cookie. FIDO2/passkeys prevent this because authentication is cryptographically bound to the origin domain — they cannot be proxied.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.