Browser Session Token Injected via MitM Attack

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•6

This rule detects potential browser session token injection via a Man-in-the-Middle (MitM) attack. It looks for HTTP responses (flow:to_client) that contain the strings "document.cookie", "=", and "XMLHttpRequest" (case-insensitive) within the file data. The combination of these strings in a client-bound HTTP response suggests an attempt to manipulate browser cookies, possibly to inject session tokens, often seen in MitM scenarios where an attacker intercepts and modifies traffic to compromise user sessions.