Use Alternate Authentication Material: Web Session Cookie T1550.004

Tactic: Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.

Authoring guide

These 8 rules share fields, values, and exclusions.

Fields filtered most (40 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
data_stream.dataset3eq 3okta.system, azure.graphactivitylogs, azure.signinlogs
data.type2eq 2seacft, sertft
okta::actor.alternateId2ne 2, regex_match 1system@okta.com, [^@\s]+\@[^@\s]+
okta::authenticationContext.externalSessionId2is_not_null 2, ne 1-, unknown
okta::eventType2eq 1, in 1user.session.start, policy.evaluate_sign_on, user.authentication.sso
Esql.azure_signinlogs_properties_app_id_coalesce_count_distinct1eq 11
Esql.client_ip_count_distinct1ge 12
Esql.dt_hash_count_distinct1ge 14
Esql.event_signin_to_graph_delay_days_date_diff1eq 10
Esql.event_signin_to_graph_delay_minutes_date_diff1gt 10
Esql.event_type_case_count_distinct1gt 11
Esql.first_replay_time1gt 1Esql.session_start_time
Esql.graph_source_asn1is_not_null 1
Esql.graph_time_min1is_not_null 1
Esql.okta_client_ip_count_distinct1gt 11

Top indicator values (44 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
data.typeeq
seacft
22
data.typeeq
sertft
22
data_stream.dataseteq
okta.system
248
data_stream.dataseteq
azure.graphactivitylogs
15
data_stream.dataseteq
azure.signinlogs
136
okta::actor.alternateIdne
system@okta.com
22
Esql.azure_signinlogs_properties_app_id_coalesce_count_distincteq
1
1
Esql.client_ip_count_distinctge
2
1
Esql.dt_hash_count_distinctge
4
1
Esql.event_signin_to_graph_delay_days_date_diffeq
0
1
Esql.event_signin_to_graph_delay_minutes_date_diffgt
0
1
Esql.event_type_case_count_distinctgt
1
1
Esql.first_replay_timegt
Esql.session_start_time
1
Esql.okta_client_ip_count_distinctgt
1
1
Esql.replay_event_countge
1
1
Esql.session_start_countge
1
1
Esql.source_as_organization_name_count_distinctgt
1
1
Esql.source_ip_count_distinctgt
1
1
Esql.suspicious_ua_countgt
0
1
Esql.user_agent_count_distinctgt
1
1
EventIDeq
policy.evaluate_sign_on
12
EventIDeq
user.authentication.sso
1
eventTypeeq
policy.evaluate_sign_on
13
eventTypeeq
user.authentication.sso
12
okta::actor.alternateIdregex_match
[^@\s]+\@[^@\s]+
1
okta::authenticationContext.externalSessionIdne
-
1
okta::authenticationContext.externalSessionIdne
unknown
1
okta::client.userAgent.rawUserAgentne
-
1
okta::debugContext.debugData.dt_hashne
-
12
okta::eventTypeeq
user.session.start
15

Exclusions (25 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
Esql.azure_signinlogs_properties_app_id_coalescein
00000007-0000-0000-c000-000000000000
1
Esql.azure_signinlogs_properties_app_id_coalescein
01fc33a7-78ba-4d2f-a4b7-768e336e890e
1
Esql.azure_signinlogs_properties_app_id_coalescein
0ec893e0-5785-4de6-99da-4ed124e5296c
1
Esql.azure_signinlogs_properties_app_id_coalescein
26a7ee05-5602-4d76-a7ba-eae8b7b67941
1
Esql.azure_signinlogs_properties_app_id_coalescein
27922004-5251-4030-b22d-91ecd9a37ea4
1
Esql.azure_signinlogs_properties_app_id_coalescein
394866fc-eedb-4f01-8536-3ff84b16be2a
1
Esql.azure_signinlogs_properties_app_id_coalescein
4354e225-50c9-4423-9ece-2d5afd904870
1
Esql.azure_signinlogs_properties_app_id_coalescein
52c2e0b5-c7b6-4d11-a89c-21e42bcec444
1
Esql.azure_signinlogs_properties_app_id_coalescein
66a88757-258c-4c72-893c-3e8bed4d6899
1
Esql.azure_signinlogs_properties_app_id_coalescein
6bc3b958-689b-49f5-9006-36d165f30e00
1
Esql.azure_signinlogs_properties_app_id_coalescein
6f7e0f60-9401-4f5b-98e2-cf15bd5fd5e3
1
Esql.azure_signinlogs_properties_app_id_coalescein
7ab7862c-4c57-491e-8a45-d52a7e023983
1
Esql.azure_signinlogs_properties_app_id_coalescein
9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7
1
Esql.azure_signinlogs_properties_app_id_coalescein
ab9b8c07-8f02-4f72-87fa-80105867a763
1
Esql.azure_signinlogs_properties_app_id_coalescein
bb893c22-978d-4cd4-a6f7-bb6cc0d6e6ce
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 2 rules

Elastic 4 rules

Splunk 1 rule

YARA-L 1 rule