huntrule

Windows Process Creation: WebBrowserPassView.exe Execution

Flags Windows execution of WebBrowserPassView.exe, a browser password recovery tool often used for credential access.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-08-20
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of WebBrowserPassView.exe, a password recovery utility associated with extracting stored browser credentials. Attackers may use it during credential-access activity to recover passwords from browsers on a compromised system. It relies on process creation telemetry, matching the process image filename ending with \WebBrowserPassView.exe and the accompanying description text.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange
Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)
Malicious Edge Credential Parser Execution via PowerShell (via process_creation)
SapphireStealer Working Directory File Drop in Temp
Malicious RemusStealer Credential Exfiltration to pics TLD C2
Suspicious Local Password Validation via dscl authonly
Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)
Suspicious BoryptGrab Infostealer Staging Directory (via file_event)
Malicious Interlock Credential Stealer Output File
Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)
Windows Process Creation: WebBrowserPassView.exe Execution
Pivot detection · T1555.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.