Windows Security 4663: Uncommon Processes Access Browser Credential Store Files

Flags 4663 file access to browser credential stores (Chromium/Firefox) by processes outside common system/benign paths.

FreeReviewedSigma · Low · v5

Product: windows
Service: security
Author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali (SigmaHQ), DRL 1.1
Published: 2024-10-21
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1555.003Credentials from Web Browsers
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file access events (EventID 4663) where a non-system, non-standard application process reads browser credential-related data paths. Accessing Chromium “User Data” login databases or Firefox cookie/history/key/login stores is a common prerequisite for credential theft. It relies on Windows Security audit telemetry for object name/file name matching plus process name exclusions to reduce benign hits.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

SapphireStealer Working Directory File Drop in Temp

Malicious RemusStealer Credential Exfiltration to pics TLD C2

Suspicious Local Password Validation via dscl authonly

Malicious Fake Fortinet Patch Infostealer Execution (via process_creation)

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Malicious Interlock Credential Stealer Output File

Malicious Browser Master Key Decryption Artifacts Written by Katz Stealer (via file_event)

Windows Security 4663: Uncommon Processes Access Browser Credential Store Files

Pivot detection · T1555.003 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-access-to-browser-credential-files-by-uncommon-processes-4b60e527

title: "Windows Security 4663: Uncommon Processes Access Browser Credential Store Files"
id: d84381b0-eb29-4074-8cda-093e1788433e
related:
  - id: 91cb43db-302a-47e3-b3c8-7ede481e27bf
    type: similar
  - id: 4b60e527-ec73-4b47-8cb3-f02ad927ca65
    type: derived
status: test
description: This rule identifies Windows file access events (EventID 4663) where a non-system, non-standard application process reads browser credential-related data paths. Accessing Chromium “User Data” login databases or Firefox cookie/history/key/login stores is a common prerequisite for credential theft. It relies on Windows Security audit telemetry for object name/file name matching plus process name exclusions to reduce benign hits.
references:
  - https://ipurple.team/2024/09/10/browser-stored-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_file_access_browser_credential.yml
author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali, Huntrule Team
date: 2024-10-21
tags:
  - attack.credential-access
  - attack.t1555.003
  - detection.threat-hunting
logsource:
  product: windows
  service: security
  definition: 'Requirements: Audit File System subcategory must be enabled. Additionally, each listed ObjectName must have "List folder/read data" auditing enabled.'
detection:
  selection_eid:
    EventID: 4663
    ObjectType: File
    AccessMask: "0x1"
  selection_browser_chromium:
    ObjectName|contains:
      - \User Data\Default\Login Data
      - \User Data\Local State
      - \User Data\Default\Network\Cookies
  selection_browser_firefox:
    FileName|endswith:
      - \cookies.sqlite
      - \places.sqlite
      - release\key3.db
      - release\key4.db
      - release\logins.json
  filter_main_system:
    ProcessName: System
  filter_main_generic:
    ProcessName|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    ProcessName|startswith: C:\ProgramData\Microsoft\Windows Defender\
    ProcessName|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  condition: selection_eid and 1 of selection_browser_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL