T1217 Browser Information Discovery — ATT&CK Technique
Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).
Detection coverage (4)
- Suspicious File Access to Browser Credential Storage low
- Automated Collection Bookmarks Using Get-ChildItem PowerShell low
- File And SubFolder Enumeration Via Dir Command low
- Suspicious Where Execution low
Malware using this technique
- Calisto
- Lizar
- Machete
- Mispadu
- BeaverTail
- PowerLess
- Dtrack
- RedLine Stealer
- DarkWatchman
- Mafalda
- Empire
- LightSpy
- SUGARDUMP
- GlassWorm
- Lumma Stealer
- Troll Stealer
- MobileOrder
- Cuckoo Stealer