Detect Credentials from Web Browsers in Microsoft Sentinel
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords in encrypted format within credential stores. On Windows, encrypted credentials may be obtained from Chrome by reading the Login Data SQLite database and decrypting via CryptUnprotectData. Firefox stores credentials in key3.db/key4.db and logins.json. Edge and Internet Explorer credentials are managed by Windows Credential Manager. Adversaries may also search browser process memory for credential patterns using tools like mimikittenz.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.003 Credentials from Web Browsers
- Canonical reference
- https://attack.mitre.org/techniques/T1555/003/
KQL Detection Query
let BrowserCredFiles = dynamic(["Login Data", "logins.json", "key3.db", "key4.db", "signons.sqlite", "Web Data", "Cookies", "Local State"]);
let BrowserCredPaths = dynamic(["Google\\Chrome\\User Data", "Mozilla\\Firefox\\Profiles", "Microsoft\\Edge\\User Data", "BraveSoftware\\Brave-Browser", "Opera Software"]);
let CredTheftTools = dynamic(["browserpassview", "webbrowserpassview", "chromepass", "mimikittenz", "browserghost", "sharpchromium", "hackbrowserdata", "lazagne"]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where (FileName has_any (BrowserCredFiles) and FolderPath has_any (BrowserCredPaths))
| where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "brave.exe", "opera.exe", "iexplore.exe", "SearchProtocolHost.exe", "SearchIndexer.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| sort by Timestamp descDetects non-browser processes accessing browser credential store files. Monitors for file access to Chrome Login Data, Firefox logins.json/key databases, Edge/Brave/Opera credential files from processes other than the owning browser. This catches credential stealers like Agent Tesla, Lumma Stealer, RedLine Stealer, and BeaverTail that directly read browser database files.
Data Sources
Required Tables
False Positives & Tuning
- Browser update processes that may access credential files during migration between versions
- Antivirus/EDR agents scanning browser credential directories during scheduled scans
- Backup software (Acronis, Veeam, Windows Backup) that reads browser profile directories
- Browser extension installers and sync services that access profile data
Other platforms for T1555.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Chrome Login Data for offline extraction
Expected signal: Sysmon Event ID 11: FileCreate for the copied Login Data file. Sysmon Event ID 1: Process Create for cmd.exe with copy command. DeviceFileEvents in MDE showing file copy from Chrome directory.
- Test 2Query Chrome credentials with sqlite3
Expected signal: Sysmon Event ID 1: Process Create with Image=sqlite3.exe, CommandLine containing 'Login Data' and 'SELECT...FROM logins'. DeviceFileEvents showing sqlite3 reading Login Data file.
- Test 3Extract Firefox credentials with LaZagne
Expected signal: Sysmon Event ID 1: Process Create with Image containing 'lazagne'. Sysmon Event ID 11: potential output file creation. Multiple file access events as LaZagne reads credential stores from all installed browsers.
References (7)
- https://attack.mitre.org/techniques/T1555/003/
- https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata
- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- https://github.com/putterpanda/mimikittenz
- https://github.com/AlessandroZ/LaZagne
- https://github.com/nicehash/HackBrowserData
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md
Unlock Pro Content
Get the full detection package for T1555.003 including response playbook, investigation guide, and atomic red team tests.