Browser Credential Theft

Description

Modern browsers store users’ login credentials, passwords, and session information locally to enhance convenience. These sensitive details are typically encrypted and saved in specific database files.

Attackers often exploit this feature by reading and decrypting these locally stored credential files, directly accessing passwords and session tokens saved in the browser.

Once obtained, attackers can use these stolen accounts to move laterally, gaining access to other systems and resources within an enterprise network. Timely detection of abnormal access to browser credential files is essential to prevent credential theft attacks.

Challenge Objective

Identify suspicious read operations on browser password or session storage files. Focus on access to these sensitive files by non-browser processes.

Consider differences in storage paths across various browsers and exclude legitimate browser processes.

When writing detection queries, ensure the Computer field is included in the output for further validation.

Data Sample

Data source: Windows Security; sample data:

{  "AccessList": "%%4416\n\t\t\t\t",  "AccessMask": "0x1",  "Channel": "Security",  "Computer": "DESKTOP-4FWM53J",  "EventId": 4663,  "HandleId": "0x144c",  "ObjectName": "C:\\Users\\admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\fdom8tsq.default-release\\logins.json",  "ObjectServer": "Security",  "ObjectType": "File",  "ProcessId": "0x1bf0",  "ProcessName": "C:\\Program Files\\Mozilla Firefox\\firefox.exe",  "ResourceAttributes": "S:AI",  "SubjectDomainName": "DESKTOP-4FWM53J",  "SubjectLogonId": "0x43293d8",  "SubjectUserName": "admin",  "SubjectUserSid": "S-1-5-21-3674539173-2368996839-3109090252-1001",  "SystemTime": "2025-07-21T08:30:24.2102954Z",}

References

• Threat Hunting: Detecting Browser Credential Stealing T1555.003