Cross-source coverage

T1555.003 / ATT&CK

Credentials from Password Stores: Credentials from Web Browsers

32 rules across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.

Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.

Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:FILEauditd:SYSCALLmacos:unifiedlog

How MITRE says to detect it DET0037

Detect Suspicious Access to Browser Credential Stores

Windows Analytic 0105

Detects unauthorized access to web browser credential stores (e.g., Chrome Login Data, Edge Credential Locker) by processes other than the browser itself. Correlates file reads of credential databases with subsequent API calls to `CryptUnprotectData` or memory inspection attempts.

  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0106

Detects attempts to access browser credential stores (e.g., Firefox `logins.json`, Chrome SQLite DB) or processes (e.g., gnome-keyring-daemon). Observes unauthorized file reads and memory inspection of browser processes using ptrace or gdb.

  • auditd:FILE /home/*/.mozilla/firefox/*/logins.json OR /home/*/.config/google-chrome/*/Login Data
  • auditd:SYSCALL ptrace attach

macOS Analytic 0107

Detects abnormal access to Safari credential stores (Keychain-backed) or Chrome/Firefox login databases. Observes processes executing `security dump-keychain` or directly reading credential files in `~/Library/Application Support`. Correlates file access with suspicious process ancestry or unsigned binaries.

  • macos:unifiedlog execution of security, sqlite3, or unauthorized binaries
  • macos:unifiedlog ~/Library/Application Support/Google/Chrome/*/Login Data OR ~/Library/Application Support/Firefox/*/logins.json

View on attack.mitre.org ↗

elastic/protections-artifacts

12 rules
Detection Severity Format
Access to Browser Credentials from Suspicious Memory Undefined Elastic TOML
Chrome Browser Spawned from an Unusual Parent Undefined Elastic TOML
Failed Access Attempt to Web Browser Files Undefined Elastic TOML
Failed Attempts to Access Sensitive Files Undefined Elastic TOML
Potential Browser Credentials Stealer Undefined Elastic TOML
Potential Google Credentials Phishing Undefined Elastic TOML
Suspicious Access to Web Browser Credential Stores Undefined Elastic TOML
Web Browser Credential Access via Scripting Utility Undefined Elastic TOML
Web Browser Credential Access via Unsigned Process Undefined Elastic TOML
Web Browser Credential Data Accessed by Osascript Undefined Elastic TOML

+ 2 more from elastic/protections-artifacts → showing the 10 highest-severity

SigmaHQ/sigma

8 rules
Detection Severity Format
HackTool - WinPwn Execution High Sigma
HackTool - WinPwn Execution - ScriptBlock High Sigma
SQLite Chromium Profile Data DB Access High Sigma
Access to Browser Login Data Medium Sigma
Potential Browser Data Stealing Medium Sigma
PUA - WebBrowserPassView Execution Medium Sigma
Access To Browser Credential Files By Uncommon Applications - Security Low Sigma
Suspicious File Access to Browser Credential Storage Low Sigma

splunk/security_content

5 rules
Detection Severity Format
Non Chrome Process Accessing Chrome Default Dir Undefined SPL
Non Firefox Process Access Firefox Profile Dir Undefined SPL
Possible Browser Pass View Parameter Undefined SPL
Windows Credentials from Password Stores Chrome Copied in TEMP Dir Undefined SPL
Windows Credentials from Web Browsers Saved in TEMP Folder Undefined SPL

elastic/detection-rules

3 rules
Detection Severity Format
Browser Process Spawned from an Unusual Parent High Elastic TOML
Keychain Password Retrieval via Command Line High Elastic TOML
Suspicious Web Browser Sensitive File Access High Elastic TOML

Wazuh Core Ruleset

2 rules
Detection Severity Format
Anomaly URL query (attempting to pass null termination). Medium Wazuh XML
The value for the parameter to the browser service was illegal Medium Wazuh XML

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Potential credential dumping with LaZagne targeting browser password stores High Wazuh XML
Powershell script: Browser/input data theft cmdlet detected High Wazuh XML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.