Stored Credentials from Web Browsers - Windows (PowerShell)

id: '14942.22051'
title: Stored Credentials from Web Browsers - Windows
description: 'Adversaries may acquire credentials from web browsers by reading files
  specific to the target browser. Web browsers commonly save credentials such as website
  usernames and passwords so that they do not need to be entered manually in the future.
  Web browsers typically store the credentials in an encrypted format within a credential
  store; however, methods exist to extract plaintext credentials from web browsers.
  After acquiring credentials from web browsers, adversaries may attempt to recycle
  the credentials across different systems and/or accounts in order to expand access.
  This can result in significantly furthering an adversary''s objective in cases where
  credentials gained from web browsers overlap with privileged accounts (e.g. domain
  administrator). This use case detects attempts to enumerate or access files containing
  stored credentials from web browsers on Windows endpoints. -- Threat Actor Association:
  Earth Estries, Scattered Spider (aka. Muddled Libra, Scatter Swine, Starfraud, UNC3944)
  -- Atomic T1555.003 Test #4 Atomic T1555.003 Test #5 Atomic T1555.003 Test #6 Atomic
  T1555.003 Test #7'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Copy-Item) OR
  TERM(copy) OR TERM(xcopy) OR TERM(cp) OR TERM(cpi) OR TERM(robocopy)) AND ("Chrome"
  OR "Opera" OR "Firefox" OR "Edge") | regex process="(?i)(Copy\-Item|copy|xcopy|[^\-]cp|[^\-]cpi|robocopy)\s+.+?((\x5cGoogle\x5cChrome\x5cUser\sData\x5cDefault\x5cLogin\s)|(\x5cOpera.+Login\s)|(\x5cFirefox\x5cProfiles)|(\x5cEdge\x5cUser\sData\x5c))"
  | table _time, host, user signature_id, process, process_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:credentials from password stores:credentials from web browsers
technique_id:
- T1555.003
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/T1555.003.md