Windows Process Copy/Move of Browser Credential Stores

title: Windows Process Copy/Move of Browser Credential Stores
id: 88a55032-0022-40a7-b8bd-8a39bae638c1
related:
  - id: fc028194-969d-4122-8abe-0470d5b8f12f
    type: derived
  - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
    type: derived
status: test
description: This rule flags Windows process activity that copies or moves files associated with browser profile and credential stores, using built-in file transfer utilities such as copy-item, xcopy, and robocopy. This behavior matters because attackers may steal saved web credentials by accessing browser-specific user data directories. It relies on process creation telemetry, including the process command line content and the executable/original file name, to identify both the file operation and the targeted browser storage paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
  - https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-03-19
tags:
  - attack.credential-access
  - attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    - CommandLine|contains:
        - copy-item
        - "copy "
        - "cpi "
        - " cp "
        - "move "
        - move-item
        - " mi "
        - " mv "
    - Image|endswith:
        - \esentutl.exe
        - \xcopy.exe
        - \robocopy.exe
    - OriginalFileName:
        - esentutl.exe
        - XCOPY.EXE
        - robocopy.exe
  selection_path:
    CommandLine|contains:
      - \Amigo\User Data
      - \BraveSoftware\Brave-Browser\User Data
      - \CentBrowser\User Data
      - \Chromium\User Data
      - \CocCoc\Browser\User Data
      - \Comodo\Dragon\User Data
      - \Elements Browser\User Data
      - \Epic Privacy Browser\User Data
      - \Google\Chrome Beta\User Data
      - \Google\Chrome SxS\User Data
      - \Google\Chrome\User Data\
      - \Kometa\User Data
      - \Maxthon5\Users
      - \Microsoft\Edge\User Data
      - \Mozilla\Firefox\Profiles
      - \Nichrome\User Data
      - \Opera Software\Opera GX Stable\
      - \Opera Software\Opera Neon\User Data
      - \Opera Software\Opera Stable\
      - \Orbitum\User Data
      - \QIP Surf\User Data
      - \Sputnik\User Data
      - \Torch\User Data
      - \uCozMedia\Uran\User Data
      - \Vivaldi\User Data
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1