Unusual process accessed web browser cookies

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Credentials Grabbing Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Steal Web Session Cookie (T1539)
Severity	Informational

An unusual process has accessed a web browser's session cookie store.

Obtain access to or hijack sessions to websites stored in the web browser's cookies.

Determine whether it is legitimate for the process to access session cookies directly.
Analyze the process/application that accessed the cookie store.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials cached in the web browser/cookie store.

An unusual process has accessed a web browser's session cookie store.

Obtain access to or hijack sessions to websites stored in the web browser's cookies.

Determine whether it is legitimate for the process to access session cookies directly.
Analyze the process/application that accessed the cookie store.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials cached in the web browser/cookie store.