Detecting Browser Cookie and Session Theft

Session cookies let an attacker walk straight past passwords and multi-factor prompts, so cookie theft is now a core stealer capability. Detection has two halves: the host, where something reads the Cookies database or drives the browser remotely, and the identity provider, where the stolen session is replayed from infrastructure the user has never used. The second half still works when the first is missed.

Signals at a Glance

Host Side: Database Reads and Debug Ports

Stealers either copy the Cookies database and decrypt it offline, or attach to a live browser through the DevTools protocol and ask for cookies directly. The second route needs a browser launched with a debugging flag, which is rare on real endpoints:

// Microsoft Defender (KQL) - browser launched with debugging or headless flags
let Browsers = dynamic(["chrome.exe","msedge.exe","brave.exe"]);
DeviceProcessEvents
| where FileName in~ (Browsers)
| where ProcessCommandLine has_any ("--remote-debugging-port", "--remote-debugging-pipe", "--headless")
| where InitiatingProcessFileName !in~ (Browsers)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessFolderPath
// tune/validate: exclude QA, RPA and developer tooling by device group or parent path

For the copy-and-decrypt route, reuse the file-access audit from the browser credential page, extending the path match to Network\Cookies and the equivalent Firefox cookies.sqlite file.

Identity Side: Session Replay

Once a cookie leaves the host, it is replayed from attacker infrastructure. The same session now appears from two places. Group sign-ins by session and look for a change of network or geography:

// Microsoft Sentinel (KQL) - one session seen from multiple IPs and countries
AADNonInteractiveUserSignInLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| summarize ips=make_set(IPAddress, 10), countries=make_set(Country, 10),
            agents=make_set(UserAgent, 10), first=min(TimeGenerated), last=max(TimeGenerated)
          by UserPrincipalName, SessionId
| where array_length(ips) > 1 and array_length(countries) > 1
// tune/validate: column names vary by workspace schema; exclude known VPN egress ranges

• Turn on token protection (device-bound sessions) in Conditional Access where your clients support it, and continuous access evaluation, so a replayed token fails from an unmanaged device.
• Shorten session lifetime for privileged roles and revoke all refresh tokens when a stealer infection is confirmed.
• Alert on new MFA method registration or mailbox rule creation shortly after a session-replay hit; that is the usual next move.