Detect Credentials from Web Browsers in Splunk
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords in encrypted format within credential stores. On Windows, encrypted credentials may be obtained from Chrome by reading the Login Data SQLite database and decrypting via CryptUnprotectData. Firefox stores credentials in key3.db/key4.db and logins.json. Edge and Internet Explorer credentials are managed by Windows Credential Manager. Adversaries may also search browser process memory for credential patterns using tools like mimikittenz.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.003 Credentials from Web Browsers
- Canonical reference
- https://attack.mitre.org/techniques/T1555/003/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*browserpassview*" OR Image="*webbrowserpassview*" OR Image="*chromepass*" OR Image="*mimikittenz*" OR Image="*browserghost*" OR Image="*sharpchromium*" OR Image="*hackbrowserdata*" OR Image="*lazagne*")
OR (CommandLine="*Login Data*" AND NOT (Image="*chrome.exe" OR Image="*msedge.exe" OR Image="*firefox.exe" OR Image="*brave.exe"))
OR (CommandLine="*logins.json*" AND NOT Image="*firefox.exe")
OR (CommandLine="*key4.db*" AND NOT Image="*firefox.exe")
OR CommandLine="*CryptUnprotectData*"
OR CommandLine="*SELECT*FROM logins*"
OR CommandLine="*SELECT*password_value*"
| eval CredTheftTool=if(match(Image, "(?i)(browserpassview|webbrowserpassview|chromepass|mimikittenz|browserghost|sharpchromium|hackbrowserdata|lazagne)"), 1, 0)
| eval BrowserFileAccess=if(match(CommandLine, "(?i)(login data|logins\.json|key4\.db|key3\.db)"), 1, 0)
| eval DPAPICall=if(match(CommandLine, "(?i)cryptunprotectdata"), 1, 0)
| eval SQLQuery=if(match(CommandLine, "(?i)(select.*from logins|select.*password_value)"), 1, 0)
| eval SuspicionScore=CredTheftTool*3 + BrowserFileAccess + DPAPICall*2 + SQLQuery*2
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, CredTheftTool, BrowserFileAccess, DPAPICall, SQLQuery, SuspicionScore
| sort - _timeDetects browser credential theft via Sysmon process creation events. Identifies known credential extraction tools, non-browser processes referencing browser credential files, CryptUnprotectData calls (used to decrypt Chrome credentials on Windows), and SQL queries targeting login/password tables in browser databases.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Browser update processes that may reference credential files in command line arguments
- Antivirus/EDR scanning browser profile directories
- Legitimate backup software that copies browser profile data
- Developer tools or database browsers used to inspect SQLite files
Other platforms for T1555.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Chrome Login Data for offline extraction
Expected signal: Sysmon Event ID 11: FileCreate for the copied Login Data file. Sysmon Event ID 1: Process Create for cmd.exe with copy command. DeviceFileEvents in MDE showing file copy from Chrome directory.
- Test 2Query Chrome credentials with sqlite3
Expected signal: Sysmon Event ID 1: Process Create with Image=sqlite3.exe, CommandLine containing 'Login Data' and 'SELECT...FROM logins'. DeviceFileEvents showing sqlite3 reading Login Data file.
- Test 3Extract Firefox credentials with LaZagne
Expected signal: Sysmon Event ID 1: Process Create with Image containing 'lazagne'. Sysmon Event ID 11: potential output file creation. Multiple file access events as LaZagne reads credential stores from all installed browsers.
References (7)
- https://attack.mitre.org/techniques/T1555/003/
- https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata
- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
- https://github.com/putterpanda/mimikittenz
- https://github.com/AlessandroZ/LaZagne
- https://github.com/nicehash/HackBrowserData
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md
Unlock Pro Content
Get the full detection package for T1555.003 including response playbook, investigation guide, and atomic red team tests.