{"id":"T1555.003","name":"Credentials from Web Browsers","url":"https://attack.mitre.org/techniques/T1555/003","tactics":["credential-access"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0037","stix_id":"x-mitre-detection-strategy--90123c20-ff3d-4034-9a5f-905444bb0311","name":"Detect Suspicious Access to Browser Credential Stores","url":"https://attack.mitre.org/detectionstrategies/DET0037","analytics":[{"id":"AN0105","stix_id":"x-mitre-analytic--c4eb93f1-0288-4884-bdbc-800e7a8e87c3","name":"Analytic 0105","description":"Detects unauthorized access to web browser credential stores (e.g., Chrome Login Data, Edge Credential Locker) by processes other than the browser itself. Correlates file reads of credential databases with subsequent API calls to `CryptUnprotectData` or memory inspection attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0037#AN0105","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredPaths","description":"Browser-specific credential storage paths such as Chrome Login Data, IE Credential Locker"},{"field":"TimeWindow","description":"Correlation window between file read and process memory/API access"}],"live":true,"detection_strategies":["DET0037"],"techniques":["T1555.003"]},{"id":"AN0106","stix_id":"x-mitre-analytic--e11709c9-0203-4f76-bbfb-379ed36723ce","name":"Analytic 0106","description":"Detects attempts to access browser credential stores (e.g., Firefox `logins.json`, Chrome SQLite DB) or processes (e.g., gnome-keyring-daemon). Observes unauthorized file reads and memory inspection of browser processes using ptrace or gdb.","url":"https://attack.mitre.org/detectionstrategies/DET0037#AN0106","platforms":["Linux"],"log_source_references":[{"name":"auditd:FILE","channel":"/home/*/.mozilla/firefox/*/logins.json OR /home/*/.config/google-chrome/*/Login Data","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-file"},{"name":"auditd:SYSCALL","channel":"ptrace attach","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"BrowserCredentialFiles","description":"Paths of web browser credential databases to monitor"},{"field":"AllowedDebuggers","description":"List of expected debugging tools for dev/test environments"}],"live":true,"detection_strategies":["DET0037"],"techniques":["T1555.003"]},{"id":"AN0107","stix_id":"x-mitre-analytic--1a068df0-67d4-4521-aeda-75fa8e9f8d98","name":"Analytic 0107","description":"Detects abnormal access to Safari credential stores (Keychain-backed) or Chrome/Firefox login databases. Observes processes executing `security dump-keychain` or directly reading credential files in `~/Library/Application Support`. Correlates file access with suspicious process ancestry or unsigned binaries.","url":"https://attack.mitre.org/detectionstrategies/DET0037#AN0107","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"execution of security, sqlite3, or unauthorized binaries","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"~/Library/Application Support/Google/Chrome/*/Login Data OR ~/Library/Application Support/Firefox/*/logins.json","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"PrivilegedUsers","description":"Expected user context authorized to unlock Keychain or browser databases"},{"field":"TimeWindow","description":"Correlation window for process execution and credential file access"}],"live":true,"detection_strategies":["DET0037"],"techniques":["T1555.003"]}],"live":true,"version":"1.0","techniques":["T1555.003"]}],"sigma_rules":[{"id":"24c77512-782b-448a-8950-eddb0785fc71","title":"SQLite Chromium Profile Data DB Access","author":"TropChaud","status":"test","level":"high","date":"2022-12-19","modified":"2023-01-19","description":"Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.","references":["https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1539","attack.t1555.003","attack.collection","attack.t1005"],"path":"rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml","techniques":["T1539","T1555.003","T1005"],"cves":[]},{"id":"47147b5b-9e17-4d76-b8d2-7bac24c5ce1b","title":"Potential Browser Data Stealing","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-12-23","modified":"2025-03-19","description":"Adversaries may acquire credentials from web browsers by reading files specific to the target browser.\nWeb browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.\nWeb browsers typically store the credentials in an encrypted format within a credential store.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md","https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml","techniques":["T1555.003"],"cves":[]},{"id":"4b60e527-ec73-4b47-8cb3-f02ad927ca65","title":"Access To Browser Credential Files By Uncommon Applications - Security","author":"Daniel Koifman (@Koifsec), Nasreddine Bencherchali","status":"test","level":"low","date":"2024-10-21","modified":null,"description":"Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing This rule requires heavy baselining before usage.\n","references":["https://ipurple.team/2024/09/10/browser-stored-credentials/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1555.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/builtin/security/win_security_file_access_browser_credential.yml","techniques":["T1555.003"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"a1dfd976-4852-41d4-9507-dc6590a3ccd0","title":"Suspicious File Access to Browser Credential Storage","author":"frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore","status":"experimental","level":"low","date":"2025-05-22","modified":null,"description":"Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.\nAdversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.\nThis behavior is often commonly observed in credential stealing malware.\n","references":["https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1","https://fourcore.io/blogs/threat-hunting-browser-credential-stealing"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.credential-access","attack.t1555.003","attack.discovery","attack.t1217"],"path":"rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml","techniques":["T1555.003","T1217"],"cves":[]},{"id":"d0dae994-26c6-4d2d-83b5-b3c8b79ae513","title":"PUA - WebBrowserPassView Execution","author":"frack113","status":"test","level":"medium","date":"2022-08-20","modified":"2023-02-14","description":"Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera","references":["https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1555.003/T1555.003.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml","techniques":["T1555.003"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"fc028194-969d-4122-8abe-0470d5b8f12f","title":"Access to Browser Login Data","author":"frack113","status":"test","level":"medium","date":"2022-01-30","modified":null,"description":"Adversaries may acquire credentials from web browsers by reading files specific to the target browser.\nWeb browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.\nWeb browsers typically store the credentials in an encrypted format within a credential store.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml","techniques":["T1555.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}