Suspicious Access to Browser Login Data (via ps_script)

title: Suspicious Access to Browser Login Data (via ps_script)
id: 2fccee6f-163b-58ec-8943-ecd85bbbd59a
status: stable
description: This rule detects threat actors may acquire credentials from web browsers by reading files specific to the target browser. Web browsers frequently save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers usually store the credentials in an encrypted format within a credential store.
references:
    - https://attack.mitre.org/techniques/T1555/003/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
author: Huntrule Team
date: 2026-01-15
tags:
    - attack.credential-access
    - attack.t1555.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmd:
        ScriptBlockText|contains|all:
            - Copy-Item
            - '-Destination'
    selection_path:
        ScriptBlockText|contains:
            - '\Opera Software\Opera Stable\Login Data'
            - '\Mozilla\Firefox\Profiles'
            - '\Microsoft\Edge\User Data\Default'
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Google\Chrome\User Data\Default\Login Data For Account'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium