Detect Credentials from Web Browsers in IBM QRadar
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords in encrypted format within credential stores. On Windows, encrypted credentials may be obtained from Chrome by reading the Login Data SQLite database and decrypting via CryptUnprotectData. Firefox stores credentials in key3.db/key4.db and logins.json. Edge and Internet Explorer credentials are managed by Windows Credential Manager. Adversaries may also search browser process memory for credential patterns using tools like mimikittenz.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.003 Credentials from Web Browsers
- Canonical reference
- https://attack.mitre.org/techniques/T1555/003/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
logsourcename(deviceid) AS LogSource,
username AS User,
sourceip AS SourceIP,
QIDNAME(qid) AS EventName,
"ProcessImage" AS ProcessImage,
"CommandLine" AS CommandLine,
"ParentImage" AS ParentProcess,
CASE
WHEN LOWER("ProcessImage") MATCHES '(?i).*(browserpassview|webbrowserpassview|chromepass|mimikittenz|browserghost|sharpchromium|hackbrowserdata|lazagne).*' THEN 3
ELSE 0
END +
CASE
WHEN LOWER("CommandLine") MATCHES '(?i).*(login data|logins\.json|key[34]\.db|signons\.sqlite|local state).*'
AND NOT LOWER("ProcessImage") MATCHES '(?i).*(chrome|msedge|firefox|brave|opera)\.exe.*' THEN 1
ELSE 0
END +
CASE
WHEN LOWER("CommandLine") MATCHES '(?i).*cryptunprotectdata.*' THEN 2
ELSE 0
END +
CASE
WHEN LOWER("CommandLine") MATCHES '(?i).*(select.*from logins|select.*password_value).*' THEN 2
ELSE 0
END AS SuspicionScore
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
AND (
LOWER("ProcessImage") MATCHES '(?i).*(browserpassview|webbrowserpassview|chromepass|mimikittenz|browserghost|sharpchromium|hackbrowserdata|lazagne).*'
OR (
LOWER("CommandLine") MATCHES '(?i).*(login data|logins\.json|key[34]\.db|signons\.sqlite).*'
AND NOT LOWER("ProcessImage") MATCHES '(?i).*(chrome|msedge|firefox|brave|opera)\.exe.*'
)
OR LOWER("CommandLine") MATCHES '(?i).*cryptunprotectdata.*'
OR LOWER("CommandLine") MATCHES '(?i).*(select.*from logins|select.*password_value).*'
)
AND starttime >= NOW() - 86400000
ORDER BY SuspicionScore DESC, starttime DESC
LAST 24 HOURSIBM QRadar AQL query detecting browser credential theft from Sysmon and Windows Security Event Log sources. Matches known credential harvesting tool names in process image paths and suspicious command-line patterns (browser credential file access by non-browser processes, DPAPI calls, SQL password queries). Applies a four-dimension suspicion scoring model to rank events by severity.
Data Sources
Required Tables
False Positives & Tuning
- Authorized penetration testing or red team operations using credential harvesting tools under a scoped engagement
- Browser migration utilities (e.g., migrating profiles from Chrome to Edge) that copy Login Data or logins.json as part of legitimate profile import
- Enterprise software deployment agents that reference browser profile paths during user onboarding or policy enforcement workflows
Other platforms for T1555.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Chrome Login Data for offline extraction
Expected signal: Sysmon Event ID 11: FileCreate for the copied Login Data file. Sysmon Event ID 1: Process Create for cmd.exe with copy command. DeviceFileEvents in MDE showing file copy from Chrome directory.
- Test 2Query Chrome credentials with sqlite3
Expected signal: Sysmon Event ID 1: Process Create with Image=sqlite3.exe, CommandLine containing 'Login Data' and 'SELECT...FROM logins'. DeviceFileEvents showing sqlite3 reading Login Data file.
- Test 3Extract Firefox credentials with LaZagne
Expected signal: Sysmon Event ID 1: Process Create with Image containing 'lazagne'. Sysmon Event ID 11: potential output file creation. Multiple file access events as LaZagne reads credential stores from all installed browsers.
References (7)
- https://attack.mitre.org/techniques/T1555/003/
- https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata
- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- https://github.com/putterpanda/mimikittenz
- https://github.com/AlessandroZ/LaZagne
- https://github.com/nicehash/HackBrowserData
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md
Unlock Pro Content
Get the full detection package for T1555.003 including response playbook, investigation guide, and atomic red team tests.