Detect Credentials from Web Browsers in Google Chronicle
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords in encrypted format within credential stores. On Windows, encrypted credentials may be obtained from Chrome by reading the Login Data SQLite database and decrypting via CryptUnprotectData. Firefox stores credentials in key3.db/key4.db and logins.json. Edge and Internet Explorer credentials are managed by Windows Credential Manager. Adversaries may also search browser process memory for credential patterns using tools like mimikittenz.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.003 Credentials from Web Browsers
- Canonical reference
- https://attack.mitre.org/techniques/T1555/003/
YARA-L Detection Query
rule t1555_003_browser_credential_theft {
meta:
author = "Detection Engineering"
description = "Detects T1555.003 - credential theft from web browsers via known harvesting tools, unauthorized access to browser credential stores, DPAPI decryption calls, and SQL queries against browser password databases"
mitre_attack_technique = "T1555.003"
mitre_attack_tactic = "Credential Access"
severity = "HIGH"
confidence = "HIGH"
reference = "https://attack.mitre.org/techniques/T1555/003/"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.principal.process.file.full_path, `(?i)(browserpassview|webbrowserpassview|chromepass|mimikittenz|browserghost|sharpchromium|hackbrowserdata|lazagne)`)
or re.regex($e.target.process.file.full_path, `(?i)(browserpassview|webbrowserpassview|chromepass|mimikittenz|browserghost|sharpchromium|hackbrowserdata|lazagne)`)
or (
re.regex($e.target.process.command_line, `(?i)(login[_ ]data|logins\.json|key[34]\.db|signons\.sqlite|local[_ ]state)`)
and not re.regex($e.principal.process.file.full_path, `(?i)(chrome\.exe|firefox\.exe|msedge\.exe|brave\.exe|opera\.exe|searchprotocolhost\.exe|searchindexer\.exe)`)
)
or re.regex($e.target.process.command_line, `(?i)cryptunprotectdata`)
or re.regex($e.target.process.command_line, `(?i)select.+(from logins|password_value)`)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting browser credential theft via UDM PROCESS_LAUNCH events. Matches on four distinct patterns: known credential harvesting tool names in the spawned process path, command-line references to browser credential store files by non-browser parent processes, DPAPI decryption function references indicating Chrome master key extraction, and SQL SELECT patterns targeting browser password tables.
Data Sources
Required Tables
False Positives & Tuning
- Automated browser testing frameworks (e.g., Puppeteer, Playwright headless) that launch Chrome or Chromium with custom profile paths referencing credential store files
- DFIR or forensic tools (Autopsy, Magnet AXIOM, Nirsoft utilities) running legitimately on endpoints during authorized investigations
- Enterprise SSO or identity management agents that interface with browser credential APIs for federated authentication bootstrapping
Other platforms for T1555.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Chrome Login Data for offline extraction
Expected signal: Sysmon Event ID 11: FileCreate for the copied Login Data file. Sysmon Event ID 1: Process Create for cmd.exe with copy command. DeviceFileEvents in MDE showing file copy from Chrome directory.
- Test 2Query Chrome credentials with sqlite3
Expected signal: Sysmon Event ID 1: Process Create with Image=sqlite3.exe, CommandLine containing 'Login Data' and 'SELECT...FROM logins'. DeviceFileEvents showing sqlite3 reading Login Data file.
- Test 3Extract Firefox credentials with LaZagne
Expected signal: Sysmon Event ID 1: Process Create with Image containing 'lazagne'. Sysmon Event ID 11: potential output file creation. Multiple file access events as LaZagne reads credential stores from all installed browsers.
References (7)
- https://attack.mitre.org/techniques/T1555/003/
- https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata
- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- https://github.com/putterpanda/mimikittenz
- https://github.com/AlessandroZ/LaZagne
- https://github.com/nicehash/HackBrowserData
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md
Unlock Pro Content
Get the full detection package for T1555.003 including response playbook, investigation guide, and atomic red team tests.