Stolen Web Session Cookie Used from New Location
This rule detects the potential use of a stolen web session cookie from a new location. It specifically looks for HTTP traffic containing common session-related keywords like 'session', 'auth', or 'token' within the HTTP cookie header. A threshold of 10 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating a potential high-frequency attempt to use a session cookie.
Suricata
