Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555.003Credentials from Web Browsers
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script content that copies files associated with browser credential stores, including Opera, Firefox profiles, and Chromium-based Edge/Chrome Login Data files. This behavior matters because attackers can steal stored website usernames and passwords that browsers keep in credential stores. The detection relies on ScriptBlockText telemetry and matches copy commands that reference specific browser Login Data paths.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

SapphireStealer Working Directory File Drop in Temp

Malicious RemusStealer Credential Exfiltration to pics TLD C2

Suspicious Local Password Validation via dscl authonly

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Malicious Interlock Credential Stealer Output File

Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)

Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Pivot detection · T1555.003 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-access-to-browser-credential-database-files-fc028194

title: Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files
id: e6c922a5-2d4b-487d-9ec2-e03714a833e5
related:
  - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d
    type: obsolete
  - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
    type: similar
  - id: fc028194-969d-4122-8abe-0470d5b8f12f
    type: derived
status: test
description: This rule identifies PowerShell script content that copies files associated with browser credential stores, including Opera, Firefox profiles, and Chromium-based Edge/Chrome Login Data files. This behavior matters because attackers can steal stored website usernames and passwords that browsers keep in credential stores. The detection relies on ScriptBlockText telemetry and matches copy commands that reference specific browser Login Data paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml
author: frack113, Huntrule Team
date: 2022-01-30
tags:
  - attack.credential-access
  - attack.t1555.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmd:
    ScriptBlockText|contains|all:
      - Copy-Item
      - -Destination
  selection_path:
    ScriptBlockText|contains:
      - \Opera Software\Opera Stable\Login Data
      - \Mozilla\Firefox\Profiles
      - \Microsoft\Edge\User Data\Default
      - \Google\Chrome\User Data\Default\Login Data
      - \Google\Chrome\User Data\Default\Login Data For Account
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL