T1217 — Browser Information Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.)…

Sigma detection rules (3)

T1217 Browser Information Discovery

title: T1217 Browser Information Discovery
id: 7e83ab26-8a54-4fc1-8dd2-8de39b4635f0
description: 'Detection of Local Browser Artifact Access for Reconnaissance via command-line access to browser profile stores (bookmarks, history, saved logins). Tune using: TargetPathRegex, ParentProcess, ScriptBlockPattern.'
references:
  - https://attack.mitre.org/techniques/T1217
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.discovery
  - attack.t1217

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'

  selection_browser_paths:
    CommandLine|contains:
      - 'Bookmarks'
      - 'places.sqlite'
      - '\User Data\Default\History'
      - '\User Data\Default\Login Data'
      - '\Mozilla\Firefox\Profiles'
      - '\AppData\Local\Google\Chrome\User Data'
      - '\AppData\Local\Microsoft\Edge\User Data'

  condition: selection and selection_browser_paths

falsepositives:
  - Legitimate browser-migration, backup, or endpoint-management tooling reading bookmark/profile files via script.

level: medium

T1217 Browser Information Discovery

title: T1217 Browser Information Discovery
id: 9dedf954-f44c-4ee6-a26b-8e1d6ffa6f48
description: 'Detection of Local Browser Artifact Access for Reconnaissance. A PATH watch on these files fires constantly from the browser''s own normal read/write activity (bookmarks/history are read and written continuously during ordinary use), which the prior falsepositives note did not account for. Added a filter excluding the browser''s own process (firefox/chrome/chromium binaries) so only access by a different, third-party process triggers. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BrowserProfilePath, ShellRegex.'
references:
  - https://attack.mitre.org/techniques/T1217
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
  - attack.discovery
  - attack.t1217

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    name|contains:
      - '/.mozilla/firefox/'
      - '/.config/google-chrome/'
      - 'places.sqlite'
      - 'Bookmarks'
  filter_browser_itself:
    exe|contains:
      - '/firefox'
      - '/chrome'
      - '/chromium'

  condition: selection and not filter_browser_itself

falsepositives:
  - Legitimate browser-profile backup/migration tooling or sync clients reading the same bookmark/history database files under a non-browser process name.

level: low

T1217 Browser Information Discovery

title: T1217 Browser Information Discovery
id: eca0cd75-d152-463c-aa68-720b2cafff93
description: 'Detection of Local Browser Artifact Access for Reconnaissance. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BrowserDBPath, NonBrowserProcessList.'
references:
  - https://attack.mitre.org/techniques/T1217
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.discovery
  - attack.t1217

logsource:
  category: process_creation
  product: macos

detection:
  selection_target:
    TargetFilename|contains:
      - '/Library/Application Support/Google/Chrome/'
      - '/Library/Application Support/Firefox/Profiles/'
      - '/Library/Application Support/com.apple.Safari/'
      - '/Library/Application Support/Microsoft Edge/'
    TargetFilename|endswith:
      - 'Bookmarks'
      - 'History'
      - 'places.sqlite'
  selection_proc:
    Image|endswith:
      - '/bash'
      - '/zsh'
      - '/python3'
      - '/osascript'
  condition: selection_target and selection_proc

falsepositives:
  - Browser sync utilities, backup tools, and profile migration scripts read the same bookmark and history databases, so this should be scoped to processes that are not the browser itself before alerting.

level: medium

Explore