High-Value Session Cookie Token
Detects high-value session cookies by name-plus-value: framework and SSO session cookies (ESTSAUTH / ESTSAUTHPERSISTENT, JSESSIONID, PHPSESSID, connect.sid, _session_id, sessionid) assigned a long token value. A captured session cookie lets an attacker resume an authenticated session and bypass MFA entirely. Bare assignments are discovery-only; HTTP cookie framing and response attributes provide the enforcement tiers.
- Type
- regex
- Engine
- universal
- Confidence
- high
- Confidence justification
- High confidence: requiring a specific high-value session-cookie name immediately assigned a 16+ character token value is a distinctive structure. Documentation that merely names these cookies without a real value will not match.
- Jurisdictions
- global
- Regulations
- GDPR
- Frameworks
- CIS Controls, ISO 27001, NIST CSF, SOC 2
- Data categories
- credentials, security
- Scope
- narrow
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported
Pattern
(?<![A-Za-z0-9_])(?:ESTSAUTHPERSISTENT|ESTSAUTH|JSESSIONID|PHPSESSID|connect\.sid|_session_id|sessionid|SSESS[a-f0-9]{8,})\s*[=:]\s*[A-Za-z0-9%._-]{16,}Corroborative evidence keywords
session cookie, session token, set-cookie, session hijack, cookie theft, MFA bypass, token theft, authentication
Proximity: 300 characters
Should match
JSESSIONID=A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4— Low-tier probe - recognized cookie assignment without HTTP framingCookie: PHPSESSID=0123456789abcdef0123456789abcdef— Medium-tier probe - recognized session token in a request Cookie headerSet-Cookie: ESTSAUTHPERSISTENT=AQABAAEAAAD-x7K2mN9pQ4sT8vW3yZ6; Path=/; Secure; HttpOnly— High-tier probe - response cookie with path and security attributes
Should not match
JSESSIONID=short— Token value too short (under 16 chars)COLORID=A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4— Unknown cookie name, not a tracked session cookieThe JSESSIONID cookie identifies the user session on the server— Prose naming the cookie with no assigned token valueCookie: JSESSIONID=REDACTED_SESSION_VALUE— Placeholder session value in an otherwise valid Cookie headerDocumentation example: Set-Cookie: PHPSESSID=0123456789abcdef0123456789abcdef; Path=/; Secure; HttpOnly— Documentation quoting a complete response cookie must not enforceSet-Cookie: csrftoken=0123456789abcdef0123456789abcdef; Secure; HttpOnly— Sibling CSRF cookie is not a tracked authenticated-session cookie
Known false positives
- Example or expired cookie values in API documentation, HAR captures used for debugging, or test fixtures. Mitigation: Require corroborative session/cookie-theft keywords and treat obvious placeholders (all zeros, "example") as non-sensitive.