Cross-source coverage
T1217 / ATT&CK
Browser Information Discovery
From MITRE ATT&CK 19.2
Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser.
Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., %APPDATA%/Google/Chrome).
- Tactics
- Discovery
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:PowerShellauditd:SYSCALLlinux:syslogmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0013
Detection of Local Browser Artifact Access for Reconnaissance
Windows Analytic 0037
Access to browser artifact locations (e.g., Chrome, Edge, Firefox) by processes like PowerShell, cmd.exe, or unknown tools, followed by file reads, decoding, or export operations indicating enumeration of bookmarks, autofill, or history databases.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 0038
Unauthorized shell or script-based access to browser config or SQLite history files, typically in ~/.config/google-chrome/, ~/.mozilla/, or ~/.var/app folders, indicating enumeration of bookmarks or saved credentials.
auditd:SYSCALLopen, read, or stat of browser config fileslinux:syslogSuspicious script or command execution targeting browser folders
macOS Analytic 0039
Scripting or CLI tool access to ~/Library/Application Support/Google/Chrome or ~/Library/Safari bookmarks, cookies, or history databases. Detection relies on unexpected processes accessing or reading from these locations.
macos:unifiedlogAccess to ~/Library/*/Safari or Chrome directories by non-browser processesmacos:osqueryprocess reading browser configuration paths
socfortress/Wazuh-Rules
10 rules · 9 families| Detection | Severity | Format |
|---|---|---|
| Possible Chromium bookmark discovery using find command (T1217) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · CMD Favorites Folder Scan (T1217) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · CMD Recursive Where Bookmark (T1217) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · CMD Recursive Where Firefox (T1217) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Bookmark File Search (T1217) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Extract Chrome History (T1217) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell Extract Edge History (T1217) | High | Wazuh XML |
| Potential Firefox bookmark database discovery using find - T1217 | Medium | Wazuh XML |
| Sysmon - Event 1: Process creation · Trusted Script Proxy Execution (T1217) 2 variants | Low | Wazuh XML |
| Sysmon - Event 1: Process creation · Trusted Script Proxy Execution (T1217) 2 variants | Low | Wazuh XML |
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| Automated Collection Bookmarks Using Get-ChildItem PowerShell | Low | Sigma |
| File And SubFolder Enumeration Via Dir Command | Low | Sigma |
| Suspicious File Access to Browser Credential Storage | Low | Sigma |
| Suspicious Where Execution | Low | Sigma |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential Browser Information Discovery | Undefined | Elastic TOML |