| Item |
Value |
| ID |
DET0074 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1550.004 (Web Session Cookie)
Analytics
IaaS
AN0201
Anomalous access to cloud web applications using session tokens without corresponding MFA/credential validation, often from unusual locations or device fingerprints.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
How far back to check for legitimate MFA or login events before token usage |
| IPGeolocationDistance |
Threshold for flagging geographically impossible logins |
SaaS
AN0202
Session cookie reuse on unmanaged browsers, devices, or client types deviating from user baseline (e.g., switching from Chrome to curl).
Log Sources
Mutable Elements
| Field |
Description |
| BrowserFingerprintMatch |
Tolerance for accepting small differences in user-agent headers |
| SessionReuseTimeout |
Time gap threshold between valid session creation and reuse |
Office Suite
AN0203
Web session tokens reused in native Office apps (e.g., Outlook, Teams) without associated token refresh or login behavior on the endpoint.
Log Sources
Mutable Elements
| Field |
Description |
| EndpointTokenSyncGap |
Allowed delta between endpoint login and cloud token reuse |