Windows Process Copy/Move of Browser Credential Stores
Identifies Windows commands copying or moving browser user data directories consistent with credential theft.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process activity that copies or moves files associated with browser profile and credential stores, using built-in file transfer utilities such as copy-item, xcopy, and robocopy. This behavior matters because attackers may steal saved web credentials by accessing browser-specific user data directories. It relies on process creation telemetry, including the process command line content and the executable/original file name, to identify both the file operation and the targeted browser storage paths.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
- cisa.govhttps://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Process Copy/Move of Browser Credential Stores
id: 88a55032-0022-40a7-b8bd-8a39bae638c1
related:
- id: fc028194-969d-4122-8abe-0470d5b8f12f
type: derived
- id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
type: derived
status: test
description: This rule flags Windows process activity that copies or moves files associated with browser profile and credential stores, using built-in file transfer utilities such as copy-item, xcopy, and robocopy. This behavior matters because attackers may steal saved web credentials by accessing browser-specific user data directories. It relies on process creation telemetry, including the process command line content and the executable/original file name, to identify both the file operation and the targeted browser storage paths.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
- https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-03-19
tags:
- attack.credential-access
- attack.t1555.003
logsource:
category: process_creation
product: windows
detection:
selection_cmd:
- CommandLine|contains:
- copy-item
- "copy "
- "cpi "
- " cp "
- "move "
- move-item
- " mi "
- " mv "
- Image|endswith:
- \esentutl.exe
- \xcopy.exe
- \robocopy.exe
- OriginalFileName:
- esentutl.exe
- XCOPY.EXE
- robocopy.exe
selection_path:
CommandLine|contains:
- \Amigo\User Data
- \BraveSoftware\Brave-Browser\User Data
- \CentBrowser\User Data
- \Chromium\User Data
- \CocCoc\Browser\User Data
- \Comodo\Dragon\User Data
- \Elements Browser\User Data
- \Epic Privacy Browser\User Data
- \Google\Chrome Beta\User Data
- \Google\Chrome SxS\User Data
- \Google\Chrome\User Data\
- \Kometa\User Data
- \Maxthon5\Users
- \Microsoft\Edge\User Data
- \Mozilla\Firefox\Profiles
- \Nichrome\User Data
- \Opera Software\Opera GX Stable\
- \Opera Software\Opera Neon\User Data
- \Opera Software\Opera Stable\
- \Orbitum\User Data
- \QIP Surf\User Data
- \Sputnik\User Data
- \Torch\User Data
- \uCozMedia\Uran\User Data
- \Vivaldi\User Data
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1