{"id":"T1217","name":"Browser Information Discovery","url":"https://attack.mitre.org/techniques/T1217","tactics":["discovery"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0013","stix_id":"x-mitre-detection-strategy--3e5e2bda-40c0-4aea-90f1-8fc52096ad5e","name":"Detection of Local Browser Artifact Access for Reconnaissance","url":"https://attack.mitre.org/detectionstrategies/DET0013","analytics":[{"id":"AN0037","stix_id":"x-mitre-analytic--c233a50c-0fdb-412b-85f6-8ff71a3539b9","name":"Analytic 0037","description":"Access to browser artifact locations (e.g., Chrome, Edge, Firefox) by processes like PowerShell, cmd.exe, or unknown tools, followed by file reads, decoding, or export operations indicating enumeration of bookmarks, autofill, or history databases.","url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0037","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"TargetPathRegex","description":"Location of browser data folders like %APPDATA%\\Google\\Chrome\\User Data or %APPDATA%\\Mozilla\\Firefox"},{"field":"ParentProcess","description":"Used to exclude known browser maintenance or backup processes"},{"field":"ScriptBlockPattern","description":"Used to detect suspicious PowerShell commands targeting browser data"}],"live":true,"detection_strategies":["DET0013"],"techniques":["T1217"]},{"id":"AN0038","stix_id":"x-mitre-analytic--4a5abd9c-b4f3-4c29-9406-82aa3401c049","name":"Analytic 0038","description":"Unauthorized shell or script-based access to browser config or SQLite history files, typically in ~/.config/google-chrome/, ~/.mozilla/, or ~/.var/app folders, indicating enumeration of bookmarks or saved credentials.","url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0038","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, read, or stat of browser config files","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Suspicious script or command execution targeting browser folders","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"BrowserProfilePath","description":"User-specific browser data folders, e.g., ~/.config/chromium/Default/History"},{"field":"ShellRegex","description":"Shell pattern detecting suspicious access to .sqlite or .json files"}],"live":true,"detection_strategies":["DET0013"],"techniques":["T1217"]},{"id":"AN0039","stix_id":"x-mitre-analytic--353e902d-b33c-466b-9276-5f224a259934","name":"Analytic 0039","description":"Scripting or CLI tool access to ~/Library/Application Support/Google/Chrome or ~/Library/Safari bookmarks, cookies, or history databases. Detection relies on unexpected processes accessing or reading from these locations.","url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0039","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Access to ~/Library/*/Safari or Chrome directories by non-browser processes","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process reading browser configuration paths","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"BrowserDBPath","description":"System-specific paths to browser databases in user Library folders"},{"field":"NonBrowserProcessList","description":"Processes not expected to touch browser DBs (e.g., curl, bash, python)"}],"live":true,"detection_strategies":["DET0013"],"techniques":["T1217"]}],"live":true,"version":"1.0","techniques":["T1217"]}],"sigma_rules":[{"id":"725a9768-0f5e-4cb3-aec2-bc5719c6831a","title":"Suspicious Where Execution","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2021-12-13","modified":"2022-06-29","description":"Adversaries may enumerate browser bookmarks to learn more about compromised hosts.\nBrowser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about\ninternal network resources such as servers, tools/dashboards, or other related infrastructure.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1217"],"path":"rules/windows/process_creation/proc_creation_win_where_browser_data_recon.yml","techniques":["T1217"],"cves":[]},{"id":"7c9340a9-e2ee-4e43-94c5-c54ebbea1006","title":"File And SubFolder Enumeration Via Dir Command","author":"frack113","status":"test","level":"low","date":"2021-12-13","modified":"2026-05-18","description":"Detects usage of the \"dir\" command part of Windows CMD with the \"/S\" command line flag in order to enumerate files in a specified directory and all subdirectories.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1217"],"path":"rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml","techniques":["T1217"],"cves":[]},{"id":"a1dfd976-4852-41d4-9507-dc6590a3ccd0","title":"Suspicious File Access to Browser Credential Storage","author":"frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore","status":"experimental","level":"low","date":"2025-05-22","modified":null,"description":"Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.\nAdversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.\nThis behavior is often commonly observed in credential stealing malware.\n","references":["https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1","https://fourcore.io/blogs/threat-hunting-browser-credential-stealing"],"logsource":{"product":"windows","category":"file_access"},"tags":["attack.credential-access","attack.t1555.003","attack.discovery","attack.t1217"],"path":"rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml","techniques":["T1555.003","T1217"],"cves":[]},{"id":"e0565f5d-d420-4e02-8a68-ac00d864f9cf","title":"Automated Collection Bookmarks Using Get-ChildItem PowerShell","author":"frack113","status":"test","level":"low","date":"2021-12-13","modified":"2022-12-25","description":"Adversaries may enumerate browser bookmarks to learn more about compromised hosts.\nBrowser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about\ninternal network resources such as servers, tools/dashboards, or other related infrastructure.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1217"],"path":"rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml","techniques":["T1217"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2020-3580","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}