Command line naming a browser session cookie store

Siemphony@siemphonyhighT1539unverified

AN1402's on-disk leg: a process created with a browser session-cookie database named on its command line. MITRE's TargetCookiePaths knob supplies the shape of what to look for — it gives the Chrome path under AppData\Local\Google\Chrome\User Data\Default\Cookies — and the three fragments matched here are authored from it, extended to the modern Chromium layout where the store moved into a per-profile Network directory, and to Firefox's cookies.sqlite. Only the copy-and-carry variant is visible this way: a stealer that opens the file through the Win32 API, or that reads the browser's memory, writes no command line at all, and the memory leg of the analytic needs Sysmon EventID 10, which is a different log source than the one this rule is written against. Security 4688 is off in a default install and needs Audit Process Creation, and its CommandLine field needs the separate Include command line in process creation events policy — without both, this rule returns nothing because nothing is being collected. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0509, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "\\Network\\Cookies" or ProcessCommandLine contains "\\User Data\\Default\\Cookies" or ProcessCommandLine contains "cookies.sqlite")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*\\Network\\Cookies*" OR CommandLine="*\\User Data\\Default\\Cookies*" OR CommandLine="*cookies.sqlite*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*\\\\network\\\\cookies*" OR TO_LOWER(process.command_line) LIKE "*\\\\user data\\\\default\\\\cookies*" OR TO_LOWER(process.command_line) LIKE "*cookies.sqlite*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\\Network\\Cookies|\\User Data\\Default\\Cookies|cookies\.sqlite)</field>    <description>Command line naming a browser session cookie store</description>    <mitre>      <id>T1539</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: browser_credential_theft
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 362adbe6-cd06-435e-8e41-0ad8e0e31a9f

ATT&CKT1539

T1539Steal Web Session Cookie

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

A process created with a browser session-cookie database named on its command line. MITRE's analytic AN1402 has two legs: on-disk access to the cookie store, and memory reads of the browser process. This rule takes the on-disk leg only, and only the loudest form of it — a path containing the cookie file typed or scripted onto a command line. The memory leg needs Sysmon EventID 10 (process_access), a different log source. Read the title literally: Command line naming a browser session cookie store. It is a mention detector. del ...\Network\Cookies and a genuine theft produce the same alert, because the rule matches a path being named, not a file being read. The title carries that honestly; make sure your SOC knows it.

02 · Telemetry you need

Process creation with a full command line. The brief maps this category to
All four backends render this one, Sentinel included.

03 · How the logic works

Three literal path fragments, no process gate at all. MITRE's TargetCookiePaths knob supplies the shape — the brief gives the Chrome path AppData\Local\Google\Chrome\User Data\Default\Cookies — and the fragments here are authored from it. \Network\Cookies is the important extension: modern Chromium moved the store into a per-profile Network directory, so that one fragment covers Edge and every non-Default profile too. cookies.sqlite is Firefox. The scope problem is what a beginner should take away. This rule covers the 2019 version of cookie theft. Since Chrome v127, App-Bound Encryption means the copied SQLite file is useless on its own, and current cookie theft mostly drives the live browser through the DevTools protocol instead: --remote-debugging-port=, --headless --remote-debugging-port=, --user-data-dir= aimed at the live profile. Every one of those is a pure command-line artefact that lands squarely in this rule's own logsource — and none of them is here. Neither is \User Data\Local State, the file holding the encrypted master key that has to be stolen alongside the database. A learner who reads this rule as "cookie theft coverage" is missing the variant that replaced the one it detects. The second gap is indirection. Because the terms are literal fragments, all of these walk past: cd into the profile directory and copy Cookies %TEMP%\c; a wildcard, copy Cooki* .; the 8.3 short name; Copy-Item with the path built by Join-Path. None needs the API-level access the description already excludes — a relative path is enough.

04 · Common false positives

Backup, endpoint-DLP and profile-migration agents that walk the user profile by
Browser support scripts resetting a corrupted cookie store, and VDI /
Your own IR and forensics tooling, which the rule's author names as the
Browser automation and test harnesses pointed at a seeded profile directory.

05 · Detection maturity

tier_1: , and no higher.** UNVERIFIED — derived from MITRE ATT&CK DET0509 and never executed against a single log line.
tier_2: confirm command-line collection is actually on, run the terms over history, add the filter that lets the level mean something.
tier_3: needs the memory leg and the correlation between a cookie read and the outbound session that follows it — neither expressible in Sigma.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add the DevTools terms, or state plainly that they are a separate rule — one or
Add a directory-level term (\User Data\Default\Network\, \User Data\) paired
Gate on parent process to knock out the scheduled backup and DLP cases; cheaper
Pair with Sysmon EventID 10 for AN1402's memory leg — the variant that writes

Declared by the author

Backup, endpoint-DLP and profile-migration agents that walk the user profile by absolute path. When one of them names the cookie database on its command line the event is byte-for-byte what a stealer produces, and only the parent process and the schedule tell them apart.
Browser support scripts that delete or reset a corrupted cookie store, and the profile-teardown steps some VDI and roaming-profile logoff scripts run at the end of every session — these recur at predictable times across the whole estate.
Forensic and incident-response tooling run by the security team itself, which reads the same file for entirely legitimate reasons and is the most likely source of the first hit this rule ever produces.
Browser automation and test harnesses that point a driver at a seeded profile directory, which puts a cookie path on the command line as part of an ordinary build.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1539, evaluated against their process_creation events.

Share this rule

/u/siemphony/362adbe6-cd06-435e-8e41-0ad8e0e31a9f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command line naming a browser session cookie store

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it