Windows File Access to Browser Credential Storage by Non-Browser Processes

ATT&CK techniques

Cred Access → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555.003Credentials from Web Browsers
Discovery
- T1217Browser Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file access where the accessed path includes browser credential storage locations (such as Login Data, Cookies, EncryptedStorage, and related browser database files) combined with browser profile subpaths. It aims to identify attempts by non-browser processes to read sensitive browser data that attackers can use to obtain usernames, passwords, and session cookies. The detection relies on file_access telemetry including the accessed FileName and the creating process Image/ParentImage to distinguish likely non-browser access.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

SapphireStealer Working Directory File Drop in Temp

Malicious RemusStealer Credential Exfiltration to pics TLD C2

Suspicious Local Password Validation via dscl authonly

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Malicious Interlock Credential Stealer Output File

Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)

Windows File Access to Browser Credential Storage by Non-Browser Processes

Pivot detection · T1555.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-access-by-non-browser-processes-to-browser-credential-storage-a1dfd976

title: Windows File Access to Browser Credential Storage by Non-Browser Processes
id: a7e28893-81d8-43ee-a3e7-973f7087257f
status: experimental
description: This rule flags Windows file access where the accessed path includes browser credential storage locations (such as Login Data, Cookies, EncryptedStorage, and related browser database files) combined with browser profile subpaths. It aims to identify attempts by non-browser processes to read sensitive browser data that attackers can use to obtain usernames, passwords, and session cookies. The detection relies on file_access telemetry including the accessed FileName and the creating process Image/ParentImage to distinguish likely non-browser access.
references:
  - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1
  - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml
author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore, Huntrule Team
date: 2025-05-22
tags:
  - attack.credential-access
  - attack.t1555.003
  - attack.discovery
  - attack.t1217
logsource:
  category: file_access
  product: windows
detection:
  selection_browser_paths:
    FileName|contains:
      - \Sputnik\Sputnik
      - \MapleStudio\ChromePlus
      - \QIP Surf
      - \BlackHawk
      - \7Star\7Star
      - \CatalinaGroup\Citrio
      - \Google\Chrome
      - \Coowon\Coowon
      - \CocCoc\Browser
      - \uCozMedia\Uran
      - \Tencent\QQBrowser
      - \Orbitum
      - \Slimjet
      - \Iridium
      - \Vivaldi
      - \Chromium
      - \GhostBrowser
      - \CentBrowser
      - \Xvast
      - \Chedot
      - \SuperBird
      - \360Browser\Browser
      - \360Chrome\Chrome
      - \Comodo\Dragon
      - \BraveSoftware\Brave-Browser
      - \Torch
      - \UCBrowser\
      - \Blisk
      - \Epic Privacy Browser
      - \Nichrome
      - \Amigo
      - \Kometa
      - \Xpom
      - \Microsoft\Edge
      - \Liebao7Default\EncryptedStorage
      - \AVAST Software\Browser
      - \Kinza
      - \Mozilla\SeaMonkey\
      - \Comodo\IceDragon\
      - \8pecxstudios\Cyberfox\
      - \FlashPeak\SlimBrowser\
      - \Moonchild Productions\Pale Moon\
  selection_browser_subpaths:
    FileName|contains:
      - \Profiles\
      - \User Data
  selection_cred_files:
    - FileName|contains:
        - \Login Data
        - \Cookies
        - \EncryptedStorage
        - \WebCache\
    - FileName|endswith:
        - cert9.db
        - cookies.sqlite
        - formhistory.sqlite
        - key3.db
        - key4.db
        - Login Data.sqlite
        - logins.json
        - places.sqlite
  filter_main_img:
    Image|endswith:
      - \Sputnik.exe
      - \ChromePlus.exe
      - \QIP Surf.exe
      - \BlackHawk.exe
      - \7Star.exe
      - \Sleipnir5.exe
      - \Citrio.exe
      - \Chrome SxS.exe
      - \Chrome.exe
      - \Coowon.exe
      - \CocCocBrowser.exe
      - \Uran.exe
      - \QQBrowser.exe
      - \Orbitum.exe
      - \Slimjet.exe
      - \Iridium.exe
      - \Vivaldi.exe
      - \Chromium.exe
      - \GhostBrowser.exe
      - \CentBrowser.exe
      - \Xvast.exe
      - \Chedot.exe
      - \SuperBird.exe
      - \360Browser.exe
      - \360Chrome.exe
      - \dragon.exe
      - \brave.exe
      - \torch.exe
      - \UCBrowser.exe
      - \BliskBrowser.exe
      - \Epic Privacy Browser.exe
      - \nichrome.exe
      - \AmigoBrowser.exe
      - \KometaBrowser.exe
      - \XpomBrowser.exe
      - \msedge.exe
      - \LiebaoBrowser.exe
      - \AvastBrowser.exe
      - \Kinza.exe
      - \seamonkey.exe
      - \icedragon.exe
      - \cyberfox.exe
      - \SlimBrowser.exe
      - \palemoon.exe
  filter_main_path:
    Image|contains:
      - \Sputnik\
      - \MapleStudio\
      - \QIP Surf\
      - \BlackHawk\
      - \7Star\
      - \Fenrir Inc\
      - \CatalinaGroup\
      - \Google\
      - \Coowon\
      - \CocCoc\
      - \uCozMedia\
      - \Tencent\
      - \Orbitum\
      - \Slimjet\
      - \Iridium\
      - \Vivaldi\
      - \Chromium\
      - \GhostBrowser\
      - \CentBrowser\
      - \Xvast\
      - \Chedot\
      - \SuperBird\
      - \360Browser\
      - \360Chrome\
      - \Comodo\
      - \BraveSoftware\
      - \Torch\
      - \UCBrowser\
      - \Blisk\
      - \Epic Privacy Browser\
      - \Nichrome\
      - \Amigo\
      - \Kometa\
      - \Xpom\
      - \Microsoft\
      - \Liebao7\
      - \AVAST Software\
      - \Kinza\
      - \Mozilla\
      - \8pecxstudios\
      - \FlashPeak\
      - \Moonchild Productions\
  filter_main_system:
    Image: System
    ParentImage: Idle
  filter_main_generic:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    Image|contains: \Microsoft\Windows Defender\
    Image|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  filter_optional_thor:
    Image|endswith:
      - \thor.exe
      - \thor64.exe
  filter_optional_msiexec:
    ParentImage: C:\Windows\System32\msiexec.exe
  filter_optional_other:
    Image|endswith: \everything.exe
  condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Antivirus, Anti-Spyware, Anti-Malware Software
  - Legitimate software accessing browser data for synchronization or backup purposes.
  - Legitimate software installed on partitions other than "C:\"
level: low
license: DRL-1.1
related:
  - id: a1dfd976-4852-41d4-9507-dc6590a3ccd0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL