Browser Information Discovery T1217

Tactic: Discovery

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Events covered

3 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 6 rules share fields, values, and exclusions.

Fields filtered most (17 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Image4ends_with 3, contains 1, eq 1, is_not_null 1, starts_with 1, wildcard 1?:\programdata\*, ?:\users\*\downloads\*, ?:\users\public\*, \360browser.exe, \360browser\
CommandLine3contains 3-encodedcommand, -s, bookmarks, cookies, cookies.sqlite
OriginalFileName2eq 2cmd.exe, where.exe
EfectiveCommand1regex_match 1regexEmpire
EventData1contains 1-encodedcommand, powershell.exe, powershell_ise.exe
EventID1eq 14688
EventType1eq 1open
ParentImage1eq 1c:\windows\system32\msiexec.exe, idle
ScriptBlockText1contains 1 -erroraction silentlycontinue, -filter bookmarks, -force
Signature1starts_with 1Microsoft
TargetFilename1wildcard 1?:\users\*\appdata\local\google\chrome\user..., ?:\users\*\appdata\local\google\chrome\user data\default\history, ?:\users\*\appdata\local\microsoft\edge\user...
file_name1contains 1, ends_with 1\360browser\browser, \360chrome\chrome, \7star\7star
process.code_signature.exists1eq 1false
process.code_signature.trusted1eq 1false
process.thread.Ext.call_stack_contains_unbacked1eq 1true

Top indicator values (205 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
CommandLinecontains
-encodedcommand
14
CommandLinecontains
-s
110
CommandLinecontains
bookmarks
12
CommandLinecontains
cookies
12
CommandLinecontains
cookies.sqlite
13
CommandLinecontains
dir
18
CommandLinecontains
formhistory.sqlite
1
CommandLinecontains
history
12
CommandLinecontains
key3.db
12
CommandLinecontains
key4.db
12
CommandLinecontains
login data
13
CommandLinecontains
logins.json
12
CommandLinecontains
places.sqlite
12
CommandLinecontains
rmdir
12
CommandLinecontains
sessionstore.jsonlz4
1
EfectiveCommandregex_match
regexEmpire
1
EventDatacontains
-encodedcommand
1
EventDatacontains
powershell.exe
1
EventDatacontains
powershell_ise.exe
1
EventDatacontains
pwsh.exe
1
EventIDeq
4688
1317
EventTypeeq
open
152
Imagecontains
\360browser\
1
Imagecontains
\360chrome\
1
Imagecontains
\7star\
1
Imagecontains
\8pecxstudios\
1
Imagecontains
\amigo\
1
Imagecontains
\avast software\
1
Imagecontains
\blackhawk\
1
Imagecontains
\blisk\
1

Exclusions (130 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Windows

Domain: Endpoint

Sigma 4 rules

Elastic 1 rule

Kusto 1 rule