Windows process execution of where.exe with browser bookmark database or history artifacts
Alerts on where.exe executions referencing browser history/bookmarks/cookie database artifacts in the command line.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-12-13
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where.exe is executed and the command line contains strings associated with browser data sources such as Firefox places.sqlite/cookies.sqlite/formhistory.sqlite/logins.json/key3.db/key4.db/sessionstore.jsonlz4 or Chrome History/Bookmarks/Cookies/Login Data. Attackers may use where.exe-like enumeration to locate or validate the presence of user or internal web artifacts that can aid discovery and follow-on access. The detection relies on process creation telemetry and string matches in the executed command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process execution of where.exe with browser bookmark database or history artifacts
id: 2213b9d7-7c00-4377-82fb-23a553a17e17
status: test
description: This rule flags Windows process creation events where.exe is executed and the command line contains strings associated with browser data sources such as Firefox places.sqlite/cookies.sqlite/formhistory.sqlite/logins.json/key3.db/key4.db/sessionstore.jsonlz4 or Chrome History/Bookmarks/Cookies/Login Data. Attackers may use where.exe-like enumeration to locate or validate the presence of user or internal web artifacts that can aid discovery and follow-on access. The detection relies on process creation telemetry and string matches in the executed command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_where_browser_data_recon.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-13
modified: 2022-06-29
tags:
- attack.discovery
- attack.t1217
logsource:
category: process_creation
product: windows
detection:
where_exe:
- Image|endswith: \where.exe
- OriginalFileName: where.exe
where_opt:
CommandLine|contains:
- places.sqlite
- cookies.sqlite
- formhistory.sqlite
- logins.json
- key4.db
- key3.db
- sessionstore.jsonlz4
- History
- Bookmarks
- Cookies
- Login Data
condition: all of where_*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a
type: derived