Stolen Session Cookie Replayed for Account Takeover
This rule detects potential account takeover attempts by identifying the replay of stolen session cookies. It specifically looks for HTTP traffic from the home network to any destination, where the HTTP cookie header contains the case-insensitive string "session". A threshold of 5 occurrences within 3 seconds, tracked by destination, is used to trigger an alert, indicating a rapid succession of session cookie replays.
Suricata
