MITRE ATT&CK technique
Browser Information Discovery detection rulesT1217
Browser Information Discovery (T1217) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 4 community-maintained Sigma detection rules in the library mapped to T1217 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Automated Collection Bookmarks Using Get-ChildItem PowerShell
lowAdversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
windows · ps_script
File And SubFolder Enumeration Via Dir Command
lowDetects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.
windows · process_creation
Suspicious File Access to Browser Credential Storage
lowDetects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.
windows · file_access
Suspicious Where Execution
lowAdversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.
windows · process_creation