Windows File Access to Browser Credential Storage by Non-Browser Processes

ATT&CK techniques

Cred Access → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555.003Credentials from Web Browsers
Discovery
- T1217Browser Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file access where the accessed path includes browser credential storage locations (such as Login Data, Cookies, EncryptedStorage, and related browser database files) combined with browser profile subpaths. It aims to identify attempts by non-browser processes to read sensitive browser data that attackers can use to obtain usernames, passwords, and session cookies. The detection relies on file_access telemetry including the accessed FileName and the creating process Image/ParentImage to distinguish likely non-browser access.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

Suspicious Chromium Browser Launch with Remote Debugging Port for Cookie Theft (via process_creation)

Malicious dllFake Stealer Execution from WindowsApps Directory (via process_creation)

Malicious macOS Stealer Staging to Users Shared Directory (via process_creation)

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

Suspicious Browser Kiosk Mode Forcing Credential Entry via process_creation

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

Windows File Access to Browser Credential Storage by Non-Browser Processes

Pivot detection · T1555.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-access-by-non-browser-processes-to-browser-credential-storage-a1dfd976

title: Windows File Access to Browser Credential Storage by Non-Browser Processes
id: a7e28893-81d8-43ee-a3e7-973f7087257f
status: experimental
description: This rule flags Windows file access where the accessed path includes browser credential storage locations (such as Login Data, Cookies, EncryptedStorage, and related browser database files) combined with browser profile subpaths. It aims to identify attempts by non-browser processes to read sensitive browser data that attackers can use to obtain usernames, passwords, and session cookies. The detection relies on file_access telemetry including the accessed FileName and the creating process Image/ParentImage to distinguish likely non-browser access.
references:
  - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1
  - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml
author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore, Huntrule Team
date: 2025-05-22
tags:
  - attack.credential-access
  - attack.t1555.003
  - attack.discovery
  - attack.t1217
logsource:
  category: file_access
  product: windows
detection:
  selection_browser_paths:
    FileName|contains:
      - \Sputnik\Sputnik
      - \MapleStudio\ChromePlus
      - \QIP Surf
      - \BlackHawk
      - \7Star\7Star
      - \CatalinaGroup\Citrio
      - \Google\Chrome
      - \Coowon\Coowon
      - \CocCoc\Browser
      - \uCozMedia\Uran
      - \Tencent\QQBrowser
      - \Orbitum
      - \Slimjet
      - \Iridium
      - \Vivaldi
      - \Chromium
      - \GhostBrowser
      - \CentBrowser
      - \Xvast
      - \Chedot
      - \SuperBird
      - \360Browser\Browser
      - \360Chrome\Chrome
      - \Comodo\Dragon
      - \BraveSoftware\Brave-Browser
      - \Torch
      - \UCBrowser\
      - \Blisk
      - \Epic Privacy Browser
      - \Nichrome
      - \Amigo
      - \Kometa
      - \Xpom
      - \Microsoft\Edge
      - \Liebao7Default\EncryptedStorage
      - \AVAST Software\Browser
      - \Kinza
      - \Mozilla\SeaMonkey\
      - \Comodo\IceDragon\
      - \8pecxstudios\Cyberfox\
      - \FlashPeak\SlimBrowser\
      - \Moonchild Productions\Pale Moon\
  selection_browser_subpaths:
    FileName|contains:
      - \Profiles\
      - \User Data
  selection_cred_files:
    - FileName|contains:
        - \Login Data
        - \Cookies
        - \EncryptedStorage
        - \WebCache\
    - FileName|endswith:
        - cert9.db
        - cookies.sqlite
        - formhistory.sqlite
        - key3.db
        - key4.db
        - Login Data.sqlite
        - logins.json
        - places.sqlite
  filter_main_img:
    Image|endswith:
      - \Sputnik.exe
      - \ChromePlus.exe
      - \QIP Surf.exe
      - \BlackHawk.exe
      - \7Star.exe
      - \Sleipnir5.exe
      - \Citrio.exe
      - \Chrome SxS.exe
      - \Chrome.exe
      - \Coowon.exe
      - \CocCocBrowser.exe
      - \Uran.exe
      - \QQBrowser.exe
      - \Orbitum.exe
      - \Slimjet.exe
      - \Iridium.exe
      - \Vivaldi.exe
      - \Chromium.exe
      - \GhostBrowser.exe
      - \CentBrowser.exe
      - \Xvast.exe
      - \Chedot.exe
      - \SuperBird.exe
      - \360Browser.exe
      - \360Chrome.exe
      - \dragon.exe
      - \brave.exe
      - \torch.exe
      - \UCBrowser.exe
      - \BliskBrowser.exe
      - \Epic Privacy Browser.exe
      - \nichrome.exe
      - \AmigoBrowser.exe
      - \KometaBrowser.exe
      - \XpomBrowser.exe
      - \msedge.exe
      - \LiebaoBrowser.exe
      - \AvastBrowser.exe
      - \Kinza.exe
      - \seamonkey.exe
      - \icedragon.exe
      - \cyberfox.exe
      - \SlimBrowser.exe
      - \palemoon.exe
  filter_main_path:
    Image|contains:
      - \Sputnik\
      - \MapleStudio\
      - \QIP Surf\
      - \BlackHawk\
      - \7Star\
      - \Fenrir Inc\
      - \CatalinaGroup\
      - \Google\
      - \Coowon\
      - \CocCoc\
      - \uCozMedia\
      - \Tencent\
      - \Orbitum\
      - \Slimjet\
      - \Iridium\
      - \Vivaldi\
      - \Chromium\
      - \GhostBrowser\
      - \CentBrowser\
      - \Xvast\
      - \Chedot\
      - \SuperBird\
      - \360Browser\
      - \360Chrome\
      - \Comodo\
      - \BraveSoftware\
      - \Torch\
      - \UCBrowser\
      - \Blisk\
      - \Epic Privacy Browser\
      - \Nichrome\
      - \Amigo\
      - \Kometa\
      - \Xpom\
      - \Microsoft\
      - \Liebao7\
      - \AVAST Software\
      - \Kinza\
      - \Mozilla\
      - \8pecxstudios\
      - \FlashPeak\
      - \Moonchild Productions\
  filter_main_system:
    Image: System
    ParentImage: Idle
  filter_main_generic:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    Image|contains: \Microsoft\Windows Defender\
    Image|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  filter_optional_thor:
    Image|endswith:
      - \thor.exe
      - \thor64.exe
  filter_optional_msiexec:
    ParentImage: C:\Windows\System32\msiexec.exe
  filter_optional_other:
    Image|endswith: \everything.exe
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Antivirus, Anti-Spyware, Anti-Malware Software
  - Legitimate software accessing browser data for synchronization or backup purposes.
  - Legitimate software installed on partitions other than "C:\"
level: low
license: DRL-1.1
related:
  - id: a1dfd976-4852-41d4-9507-dc6590a3ccd0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL