Home/ MITRE Matrix/ Lateral Movement/ T1550.004

T1550.004Web Session Cookie

T1550.004 — Web Session Cookie is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 8 detection use cases covering it and 5 threat-intel articles citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

5Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1550 · Use Alternate Authentication Material

Use cases covering this technique (8)

[WEEKLY] Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request Internal actions · alerting DSPDD Okta Multiple Failed Requests to Access Applications ESCU actions · hunting P [LLM] Gitea same-user auth failure + success from different IPs within 2 minutes Bespoke exploit · alerting SP [LLM] MantisBT self-registration (signup.php) followed by SOAP replay to mantisconnect.php from same source Bespoke exploit · hunting SP [LLM] First-seen SOAP client on MantisBT mantisconnect.php (new source, post-bypass admin activity) Bespoke exploit · hunting SP [LLM] FacturaScripts account takeover: /AdminPlugins access following filter[] SQLi from same source Bespoke actions · alerting SP [LLM] Kimai authenticated session activity with no preceding form-login POST (forged remember-me cookie) Bespoke exploit · hunting SP [LLM] Reuse of CircleCI-exfiltrated secrets / stolen SSO session from breach attacker IPs Bespoke actions · hunting DSΣPDDCSCW

Articles citing this technique (5)

crit [GHSA / CRITICAL] CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session art-126

crit [GHSA / CRITICAL] CVE-2026-47156: MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator art-166

crit [GHSA / CRITICAL] CVE-2026-45262: FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesi art-177

crit [GHSA / CRITICAL] CVE-2026-52824: Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover art-183

high Supply chain security incident at CircleCI: Rotate your secrets art-1872