tfMITRE ATT&CK technique

Browser Information Discovery T1217

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 18 April 2018
Last modified: 12 May 2026
Contributors: Mike Kemmerer; Manikantan Srinivasan, NEC Corporation India; Yinon Engelsman, Talon Cyber Security; Yonatan Gotlib, Talon Cyber Security

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 23%

Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 10%

Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 19%

Tools & malware81st percentile · 81% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Browser Information Discovery MITRE reference T1217

Top 23%of all ATT&CK techniques for number of groups

7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Moonstone SleetG1036 ↗

Deployed malware such as YouieLoader capable of capturing victim system browser information.1

created 2024-08-261 referenceaka Storm-1789

Volt TyphoonG1017 ↗

Has targeted the browsing history of network administrators.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Scattered SpiderG1015 ↗

Retrieves browser histories via infostealer malware such as Raccoon Stealer.1

created 2023-07-051 referenceaka Roasted 0ktapus

Fox KittenG0117 ↗

Has used Google Chrome bookmarks to identify internal resources and assets.1

created 2020-12-211 referenceaka UNC757

ChimeraG0114 ↗

Has used <code>type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix*</code> for bookmark discovery.1

created 2020-08-241 reference

KimsukyG0094 ↗

Has collected sensitive browser data using the function GetBrowserData() to include login credentials, bookmarks, cookies, and encryption keys.1

created 2019-08-261 referenceaka Black Banshee

All 7 groups for this technique · 6 newest in this preview

18 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

GlassWormS9010 ↗

Has searched browser data for cookies, history, login databases, and cryptocurrency wallets.1

created 2026-04-10MALWARE

BeaverTailS1246 ↗

Has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.1 2 3 4 5 6 7

created 2025-10-19MALWAREcarried by 1 group

RedLine StealerS1240 ↗

Can collect information from browsers and browser extensions.1

created 2025-09-17MALWARE

Lumma StealerS1213 ↗

Has identified and gathered information from two-factor authentication extensions for multiple browsers.1

created 2025-03-22MALWARE

Troll StealerS1196 ↗

Collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.1 2

created 2025-01-17MALWAREcarried by 1 group

LightSpyS1185 ↗

To collect data on the host's Wi-Fi connection history, LightSpy reads the /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file. It also utilizes Apple's CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.1

created 2025-01-03MALWAREcarried by 1 group

All 18 software entries for this technique · 6 newest in this preview

Offense vs defense T1217

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 3Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2021 Q4 · 3 of 4 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2018 window)

Browser Information Discovery detection strategy DET0013

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Local Browser Artifact Access for Reconnaissance

Enterprise

3 platforms

AN0037 · Windows

Access to browser artifact locations (e.g., Chrome, Edge, Firefox) by processes like PowerShell, cmd.exe, or unknown tools, followed by file reads, decoding, or export operations indicating enumeration of bookmarks, autofill, or history databases.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetPathRegex	Location of browser data folders like %APPDATA%\Google\Chrome\User Data or %APPDATA%\Mozilla\Firefox
ParentProcess	Used to exclude known browser maintenance or backup processes
ScriptBlockPattern	Used to detect suspicious PowerShell commands targeting browser data

AN0038 · Linux

Unauthorized shell or script-based access to browser config or SQLite history files, typically in ~/.config/google-chrome/, ~/.mozilla/, or ~/.var/app folders, indicating enumeration of bookmarks or saved credentials.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	auditd:SYSCALL	open, read, or stat of browser config files
Command ExecutionDC0064	linux:syslog	Suspicious script or command execution targeting browser folders

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BrowserProfilePath	User-specific browser data folders, e.g., ~/.config/chromium/Default/History
ShellRegex	Shell pattern detecting suspicious access to .sqlite or .json files

AN0039 · macOS

Scripting or CLI tool access to ~/Library/Application Support/Google/Chrome or ~/Library/Safari bookmarks, cookies, or history databases. Detection relies on unexpected processes accessing or reading from these locations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process reading browser configuration paths
File AccessDC0055	macos:unifiedlog	Access to ~/Library/*/Safari or Chrome directories by non-browser processes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BrowserDBPath	System-specific paths to browser databases in user Library folders
NonBrowserProcessList	Processes not expected to touch browser DBs (e.g., curl, bash, python)

Tests11Executorssh 5 · PowerShell 3 · cmd 3Need elevation2 of 11Have prerequisites0Have cleanup7Platformslinux, macos, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux

linux

—

Yes

Searches for Mozilla Firefox's places.sqlite file (on FreeBSD or Linux distributions) that contains bookmarks and lists any found instances to a text file.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1217-Firefox.txt	Path where captured results will be placed.

Attack command

find / -path "*.mozilla/firefox/*/places.sqlite" 2>/dev/null -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null

Cleanup command

rm -f #{output_file} 2>/dev/null

GUID6b7bb3a5-50ca-40b6-9013-b660bf98c203

List Mozilla Firefox Bookmark Database Files on macOS

macos

—

Yes

Searches for Mozilla Firefox's places.sqlite file (on macOS) that contains bookmarks and lists any found instances to a text file.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1217_Firefox.txt	Path where captured results will be placed.

Attack command

find / -path "*/Firefox/Profiles/*/places.sqlite" -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null

Cleanup command

rm -f #{output_file} 2>/dev/null

GUIDb571cdb0-02d4-400a-9873-0482b630b952

List Google Chrome Bookmark JSON Files on macOS

macos

—

Yes

Searches for Google Chrome's Bookmark file (on macOS) that contains bookmarks in JSON format and lists any found instances to a text file.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1217-Chrome.txt	Path where captured results will be placed.

Attack command

find / -path "*/Google/Chrome/*/Bookmarks" -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null

Cleanup command

rm -f #{output_file} 2>/dev/null

GUID82c66139-a098-4a81-b38b-315278e629ea

List Google Chromium Bookmark JSON Files on FreeBSD

linux

—

Yes

Searches for Google Chromium's Bookmark file (on FreeBSD) that contains bookmarks in JSON format and lists any found instances to a text file.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1217-Chrome.txt	Path where captured results will be placed.

Attack command

find / -path "*/.config/chromium/*/Bookmarks" -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null

Cleanup command

rm -f #{output_file} 2>/dev/null

GUIDa3c235bb-3b34-4fb8-be8c-9805458cbb83

List Google Chrome / Opera Bookmarks on Windows with powershell

windows

PowerShell

—

List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt

windows

cmd

—

List Mozilla Firefox bookmarks on Windows with command prompt

windows

cmd

—

List Internet Explorer Bookmarks using the command prompt

windows

cmd

—

List Safari Bookmarks on MacOS

macos

—

Yes

This test searches for Safari's Bookmarks file (on macOS) and lists any found instances to a text file.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1217-Safari.txt	Path where captured results will be placed.

Attack command

find / -path "*/Safari/Bookmarks.plist" 2>/dev/null >> #{output_file} 
cat #{output_file}

Cleanup command

rm -f #{output_file} 2>/dev/null

GUIDb54fecb6-bbe8-4e85-8ad4-626d25d87e4b

Extract Edge Browsing History

windows

PowerShell

Required

—

Yes

This test will extract Microsoft Edge browser's history of current user

Input arguments

Name	Type	Default	Description
dest_path	String	$Env:USERPROFILE\Downloads\edgebrowsinghistory.txt	Target file path to where the history to be extracted
history_path	String	$Env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History	Microsoft Edge browser history file path

Attack command

$URL_Regex = '(htt(p|s))://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?'
$History = Get-Content -Path "#{history_path}" | Select-String -AllMatches $URL_Regex | ForEach-Object { $_.Matches.Value } | Sort -Unique
$History | Out-File -FilePath "#{dest_path}"

Cleanup command

Remove-Item -Path "#{dest_path}"

GUID42e3457d-a776-4cc7-9b2e-f5fea5b35029

Extract chrome Browsing History

windows

PowerShell

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Browser Information Discovery detections T1217

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs