Detect Credentials from Web Browsers in CrowdStrike LogScale
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords in encrypted format within credential stores. On Windows, encrypted credentials may be obtained from Chrome by reading the Login Data SQLite database and decrypting via CryptUnprotectData. Firefox stores credentials in key3.db/key4.db and logins.json. Edge and Internet Explorer credentials are managed by Windows Credential Manager. Adversaries may also search browser process memory for credential patterns using tools like mimikittenz.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.003 Credentials from Web Browsers
- Canonical reference
- https://attack.mitre.org/techniques/T1555/003/
LogScale Detection Query
#event_simpleName = ProcessRollup2
| CredTheftTool := if(regex("(?i)(browserpassview|webbrowserpassview|chromepass|mimikittenz|browserghost|sharpchromium|hackbrowserdata|lazagne)", field=ImageFileName, strict=false), "true", "false")
| BrowserFileAccess := if(regex("(?i)(login data|logins\\.json|key[34]\\.db|signons\\.sqlite|local state)", field=CommandLine, strict=false), "true", "false")
| DPAPICall := if(regex("(?i)cryptunprotectdata", field=CommandLine, strict=false), "true", "false")
| SQLQuery := if(regex("(?i)(select.+from logins|select.+password_value)", field=CommandLine, strict=false), "true", "false")
| LegitBrowser := if(regex("(?i)(\\\\chrome\\.exe|\\\\firefox\\.exe|\\\\msedge\\.exe|\\\\brave\\.exe|\\\\opera\\.exe|\\\\searchprotocolhost\\.exe|\\\\searchindexer\\.exe)$", field=ImageFileName, strict=false), "true", "false")
| SuspicionScore := (case { CredTheftTool = "true" | 3 ; * | 0 }) + (case { BrowserFileAccess = "true" AND LegitBrowser = "false" | 1 ; * | 0 }) + (case { DPAPICall = "true" | 2 ; * | 0 }) + (case { SQLQuery = "true" | 2 ; * | 0 })
| SuspicionScore > 0
| sort(SuspicionScore, order=desc)
| select([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, CredTheftTool, BrowserFileAccess, DPAPICall, SQLQuery, SuspicionScore])CrowdStrike Falcon LogScale (CQL) detection for T1555.003 using ProcessRollup2 events from the Falcon sensor. Evaluates four detection dimensions via conditional field assignment: credential harvesting tool image names, unauthorized browser credential file access in the command line, DPAPI function references, and SQL queries targeting browser password stores. Excludes legitimate browser processes from file access scoring and ranks results by suspicion score.
Data Sources
Required Tables
False Positives & Tuning
- Security tooling or vulnerability scanners deployed by the SOC that spawn processes referencing browser credential file paths as part of authorized endpoint auditing
- Browser management or fleet tooling (e.g., Google Admin, Microsoft Intune browser extensions) that references profile directories during policy enforcement
- Custom enterprise scripts for browser configuration management that interact with Chrome or Firefox profile paths on managed endpoints
Other platforms for T1555.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Chrome Login Data for offline extraction
Expected signal: Sysmon Event ID 11: FileCreate for the copied Login Data file. Sysmon Event ID 1: Process Create for cmd.exe with copy command. DeviceFileEvents in MDE showing file copy from Chrome directory.
- Test 2Query Chrome credentials with sqlite3
Expected signal: Sysmon Event ID 1: Process Create with Image=sqlite3.exe, CommandLine containing 'Login Data' and 'SELECT...FROM logins'. DeviceFileEvents showing sqlite3 reading Login Data file.
- Test 3Extract Firefox credentials with LaZagne
Expected signal: Sysmon Event ID 1: Process Create with Image containing 'lazagne'. Sysmon Event ID 11: potential output file creation. Multiple file access events as LaZagne reads credential stores from all installed browsers.
References (7)
- https://attack.mitre.org/techniques/T1555/003/
- https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata
- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- https://github.com/putterpanda/mimikittenz
- https://github.com/AlessandroZ/LaZagne
- https://github.com/nicehash/HackBrowserData
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md
Unlock Pro Content
Get the full detection package for T1555.003 including response playbook, investigation guide, and atomic red team tests.