BIOC
Informational
✕
Credentials from Web Browsers
Detects attempt to copy browser files to acquire credentials.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
Indicator:
Process action type = execution AND target process cmd =~ .*[/]Application Support[/](Island|Google)([/]Chrome[/]Default|[/]Chrome[/]User Data[/]Default)?[/].*Login Data.* AND target process name = cp
Preventable: yes