# T1539 - Steal Web Session Cookie

## SOC Recommendation
Investigate Steal Web Session Cookie activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Credential Compromise Scope Analysis | Detect | Monitor for Credential Compromise Scope Analysis indicators relevant to this technique. |
| Credential Hardening | Harden | Apply Credential Hardening to reduce this technique's viability before an incident occurs. |
| Credential Revocation | Evict | Use Credential Revocation to remove the adversary's foothold once this technique is confirmed. |
| Credential Transmission Scoping | Isolate | Apply Credential Transmission Scoping to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke ALL active sessions — Entra ID | Medium | No | Yes |
| Reset password + force MFA re-enrolment | Medium | No | Yes |
| Review and delete any inbox forwarding rules created | Low | Yes | No |
| Review and revoke any OAuth app consents granted | Medium | No | Yes |
| Deploy or verify: Conditional Access policy requiring compli | Low | No | Yes |

## KQL
```kql
let TrustedRanges =
    _GetWatchlist('TrustedVPNRanges')
    | extend VPNRange = tostring(column_ifexists("SearchKey", column_ifexists("Subnet", "")))
    | where isnotempty(VPNRange)
    | summarize by VPNRange;
let MfaSignins = SigninLogs
    | where TimeGenerated >= ago(1h)
    | where ResultType == "0"
    | where IPAddress !in (TrustedRanges)
    | where tostring(AuthenticationRequirement) == "multiFactorAuthentication"
    | extend Lat = todouble(LocationDetails.geoCoordinates.latitude), Lon = todouble(LocationDetails.geoCoordinates.longitude), City = tostring(LocationDetails.city)
    | project TimeGenerated, UserPrincipalName, IPAddress, Lat, Lon, City, AppDisplayName;
MfaSignins
| join kind=inner (
    SigninLogs
    | where TimeGenerated >= ago(1h) and ResultType == "0"
    | where IPAddress !in (TrustedRanges)
    | where tostring(AuthenticationRequirement) == "singleFactorAuthentication"
    | extend Lat2 = todouble(LocationDetails.geoCoordinates.latitude), Lon2 = todouble(LocationDetails.geoCoordinates.longitude), City2 = tostring(LocationDetails.city)
    | project TimeGenerated2 = TimeGenerated, UserPrincipalName, IPAddress2 = IPAddress, Lat2, Lon2, City2, AppDisplayName2 = AppDisplayName
) on UserPrincipalName
| where TimeGenerated2 > TimeGenerated and IPAddress != IPAddress2
| where datetime_diff('minute', TimeGenerated2, TimeGenerated) <= 30
| extend DistKm = round(6371.0 * 2 * asin(sqrt(pow(sin((Lat2 - Lat) * pi() / 360), 2) + cos(Lat * pi() / 180) * cos(Lat2 * pi() / 180) * pow(sin((Lon2 - Lon) * pi() / 360), 2))), 0)
| where DistKm > 50
| distinct TimeGenerated2, UserPrincipalName, IPAddress, IPAddress2, City, City2, DistKm, AppDisplayName2
| extend timestamp = TimeGenerated2, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress2
| order by DistKm desc
```
```kql
Alerts_compromised_endpoints_cookies
| where Service == "compromised_endpoints_cookies"
| extend MappedSeverity = Severity
```

## Escalation Criteria
- Steal Web Session Cookie activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.