Techniques › T1555 › T1555.003
T1555.003 Credentials from Web Browsers
credential access — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
8
Sigma rules tagged attack.t1555.003
0
KEV CVEs mapped here
<p>Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.</p><p>For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, <code>AppData\Local\Google\Chrome\User Data\Default\Login Data</code> and executing a SQL query: <code>SELECT action_url, username_value, password_value FROM logins;</code>. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function <code>CryptUnprotectData</code>, which uses the victim’s cached logon credentials as the decryption key.</p><p>Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.</p><p>Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.</p><p>After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0037 Detect Suspicious Access to Browser Credential Stores v1.0
AN0105 WindowsDetects unauthorized access to web browser credential stores (e.g., Chrome Login Data, Edge Credential Locker) by processes other than the browser itself. Correlates file reads of credential databases with subsequent API calls to
CryptUnprotectDataor memory inspection attempts.Tunable:MonitoredPathsTimeWindowAN0106 LinuxDetects attempts to access browser credential stores (e.g., Firefoxlogins.json, Chrome SQLite DB) or processes (e.g., gnome-keyring-daemon). Observes unauthorized file reads and memory inspection of browser processes using ptrace or gdb.auditd:FILE/home/*/.mozilla/firefox/*/logins.json OR /home/*/.config/google-chrome/*/Login Data→ DC0055 File AccessTunable:BrowserCredentialFilesAllowedDebuggersAN0107 macOSDetects abnormal access to Safari credential stores (Keychain-backed) or Chrome/Firefox login databases. Observes processes executingsecurity dump-keychainor directly reading credential files in~/Library/Application Support. Correlates file access with suspicious process ancestry or unsigned binaries.macos:unifiedlog~/Library/Application Support/Google/Chrome/*/Login Data OR ~/Library/Application Support/Firefox/*/logins.json→ DC0055 File AccessTunable:PrivilegedUsersTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1555.003
Author: TropChaud
· 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-23 (modified 2025-03-19) · logsource: product=windows category=process_creation · 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali
· 2024-10-21 · logsource: product=windows service=security · 4b60e527-ec73-4b47-8cb3-f02ad927ca65
Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing This rule requires heavy baselining before usage.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore
· 2025-05-22 · logsource: product=windows category=file_access · a1dfd976-4852-41d4-9507-dc6590a3ccd0
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.
Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
This behavior is often commonly observed in credential stealing malware.
Author: frack113
· 2022-08-20 (modified 2023-02-14) · logsource: product=windows category=process_creation · d0dae994-26c6-4d2d-83b5-b3c8b79ae513
Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: frack113
· 2022-01-30 · logsource: product=windows category=ps_script · fc028194-969d-4122-8abe-0470d5b8f12f
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Rules tagged at the parent level (attack.t1555) 8
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Florian Roth (Nextron Systems)
· 2021-07-14 (modified 2022-07-14) · logsource: product=windows category=process_creation · 58f4ea09-0fc2-4520-ba18-b85c540b0eaf
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Author: frack113
· 2021-12-20 (modified 2022-12-25) · logsource: product=windows category=ps_script · 603c6630-5225-49c1-8047-26c964553e0e
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-02-04) · logsource: product=windows category=process_creation · 7679d464-4f74-45e2-9e01-ac66c5eb041a
Detects the execution of SecurityXploded Tools
Author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
· 2024-06-26 · logsource: product=windows category=file_event · 7892ec59-c5bb-496d-8968-e5d210ca3ac4
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=ps_script · 851fd622-b675-4d26-b803-14bc7baa517a
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Author: frack113
· 2021-12-20 (modified 2022-12-25) · logsource: product=windows category=ps_script · 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Author: Swachchhanda Shrawan Poudel
· 2023-12-04 · logsource: product=windows category=process_creation · d557dc06-62e8-4468-a8e8-7984124908ce
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.