huntrule

Windows Process Creation: WebBrowserPassView.exe Execution

Flags Windows execution of WebBrowserPassView.exe, a browser password recovery tool often used for credential access.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: WebBrowserPassView.exe Execution"
id: 38f595a2-13f4-4e28-b577-3908872fef34
status: test
description: This rule identifies execution of WebBrowserPassView.exe, a password recovery utility associated with extracting stored browser credentials. Attackers may use it during credential-access activity to recover passwords from browsers on a compromised system. It relies on process creation telemetry, matching the process image filename ending with \WebBrowserPassView.exe and the accompanying description text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1555.003/T1555.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-02-14
tags:
  - attack.credential-access
  - attack.t1555.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: Web Browser Password Viewer
    - Image|endswith: \WebBrowserPassView.exe
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: d0dae994-26c6-4d2d-83b5-b3c8b79ae513
    type: derived

What it detects

This rule identifies execution of WebBrowserPassView.exe, a password recovery utility associated with extracting stored browser credentials. Attackers may use it during credential-access activity to recover passwords from browsers on a compromised system. It relies on process creation telemetry, matching the process image filename ending with \WebBrowserPassView.exe and the accompanying description text.

Known false positives

  • Legitimate use

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.