Moonstone SleetG1036 ↗
Deployed malware such as YouieLoader capable of capturing victim system browser information.1
tfMITRE ATT&CK technique
Browser Information Discovery T1217
- Tactic
- Discovery
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 18 April 2018
- Last modified
- 12 May 2026
- Contributors
- Mike Kemmerer; Manikantan Srinivasan, NEC Corporation India; Yinon Engelsman, Talon Cyber Security; Yonatan Gotlib, Talon Cyber Security
Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 75% of ATT&CK techniques have fewer threat groups attributed.4
CampaignsTop 10%
Campaigns90th percentile · 88% of ATT&CK techniques have fewer campaigns recorded.18
Tools & malwareTop 19%
Tools & malware81st percentile · 80% of ATT&CK techniques have fewer tools implementing them.4
Detection rules60th pct
Detection rules60th percentile · 54% of ATT&CK techniques have fewer detection rules written.