Query: detect Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm in logs
Matching passage: Sigma rule: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm. Logsource: windows / ps_script. Rule: title: Access to Browser Login Data id: fc028194-969d-4122-8abe-0470d5b8f12f related: - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d type: obsolete - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b type: similar status: test description: 'Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md author: frack113 date: 2022-01-30 tags: - attack.credential-access - attack.t1555.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Copy-Item - -Destination selection_path: ScriptBlockText|contains: - \Opera Software\Opera Stable\Login Data - \Mozilla\Firefox\Profiles - \Microsoft\Edge\User Data\Default - \Google\Chrome\User Data\Default\Login Data - \Google\Chrome\User Data\Default\Login Data For Account condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.. Logsource: windows / process_access. Rule: title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs id: 9f5c1d59-33be-4e60-bcab-85d2f566effd related: - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 type: similar status: experimental description: 'Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques. ' references: - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.credential-access - attack.defense-impairment - attack.t1003.001 - attack.t1685 logsource: category: process_access product: windows detection: selection_lsass_calltrace: TargetImage|endswith: \lsass.exe CallTrace|contains: - dbgcore.dll - dbghelp.dll selection_susp_location: SourceImage|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Documents\ - \Downloads\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Possibly during software installation or update processes level: high regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml