Windows Security 4663: Uncommon Processes Access Browser Credential Store Files

Flags 4663 file access to browser credential stores (Chromium/Firefox) by processes outside common system/benign paths.

FreeReviewedSigma · Low · v5

Product: windows
Service: security
Author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2024-10-21
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555.003Credentials from Web Browsers
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file access events (EventID 4663) where a non-system, non-standard application process reads browser credential-related data paths. Accessing Chromium “User Data” login databases or Firefox cookie/history/key/login stores is a common prerequisite for credential theft. It relies on Windows Security audit telemetry for object name/file name matching plus process name exclusions to reduce benign hits.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Malicious Browser Credential Dump File Drop by Phantom Stealer via file_event

Suspicious Chromium Browser Launch with Remote Debugging Port for Cookie Theft (via process_creation)

Malicious dllFake Stealer Execution from WindowsApps Directory (via process_creation)

Malicious macOS Stealer Staging to Users Shared Directory (via process_creation)

Possible Spectre Ops C2 Beacon via nico and yfat Query Parameters via proxy

Suspicious Browser Kiosk Mode Forcing Credential Entry via process_creation

Malicious Live Ledger Stealer Execution via Ledger Lives Masquerade via process_creation

Suspicious Access to Chrome Encrypted Preference MAC Registry Values (via registry_set)

Windows Security 4663: Uncommon Processes Access Browser Credential Store Files

Pivot detection · T1555.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-access-to-browser-credential-files-by-uncommon-processes-4b60e527

title: "Windows Security 4663: Uncommon Processes Access Browser Credential Store Files"
id: d84381b0-eb29-4074-8cda-093e1788433e
related:
  - id: 91cb43db-302a-47e3-b3c8-7ede481e27bf
    type: similar
  - id: 4b60e527-ec73-4b47-8cb3-f02ad927ca65
    type: derived
status: test
description: This rule identifies Windows file access events (EventID 4663) where a non-system, non-standard application process reads browser credential-related data paths. Accessing Chromium “User Data” login databases or Firefox cookie/history/key/login stores is a common prerequisite for credential theft. It relies on Windows Security audit telemetry for object name/file name matching plus process name exclusions to reduce benign hits.
references:
  - https://ipurple.team/2024/09/10/browser-stored-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_file_access_browser_credential.yml
author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali, Huntrule Team
date: 2024-10-21
tags:
  - attack.credential-access
  - attack.t1555.003
  - detection.threat-hunting
logsource:
  product: windows
  service: security
  definition: 'Requirements: Audit File System subcategory must be enabled. Additionally, each listed ObjectName must have "List folder/read data" auditing enabled.'
detection:
  selection_eid:
    EventID: 4663
    ObjectType: File
    AccessMask: "0x1"
  selection_browser_chromium:
    ObjectName|contains:
      - \User Data\Default\Login Data
      - \User Data\Local State
      - \User Data\Default\Network\Cookies
  selection_browser_firefox:
    FileName|endswith:
      - \cookies.sqlite
      - \places.sqlite
      - release\key3.db
      - release\key4.db
      - release\logins.json
  filter_main_system:
    ProcessName: System
  filter_main_generic:
    ProcessName|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    ProcessName|startswith: C:\ProgramData\Microsoft\Windows Defender\
    ProcessName|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  condition: selection_eid and 1 of selection_browser_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL