Threat video1:00
Vercel DBSC Session Cookie Binding: Analysis & Hunting
Vercel binds login sessions to a TPM-held key, so stolen infostealer cookies fail elsewhere. It lists 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for Vercel DBSC Session Cookie Binding: Analysis & Hunting →
Chapters
- 0:00The hookWith DBSC, stolen session cookies expire within minutes.
- 0:05The storyApril incident: stolen cookies exposed.
- 0:11Attack pathOAuth compromise led to Vercel account takeover.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromise2 indicators to hunt: 1 URL and 1 registry key.
- 0:37MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to collection.
- 0:42Remediation4 steps now: Enable MFA on all Vercel accounts.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00With DBSC, stolen session cookies expire within minutes.
0:05April incident: stolen cookies exposed.
0:08Now they expire within minutes.
0:11OAuth compromise led to Vercel account takeover.
0:15Stealer bypassed ABE, extracted and replayed cookies.
0:18DBSC binding reportedly makes replay fail within minutes.
0:27No threat actor is attributed. Confidence: low.
0:322 indicators to hunt: 1 URL and 1 registry key.
0:388 ATT&CK techniques, from initial access to collection.
0:434 steps now: Enable MFA on all Vercel accounts.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.