T1555.003 — Credentials from Web Browsers

Tactic: Credential Access · Platforms: Linux, macOS, Windows

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an…

Sub-technique of Credentials from Password Stores (T1555).

Sigma detection rules (3)

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

title: "T1555.003 Credentials from Password Stores: Credentials from Web Browsers"
id: c180d1a4-257c-4b4d-b243-83af5da89e5b
description: 'Detect Suspicious Access to Browser Credential Stores. (Retargeted from the original process_creation label to process_access — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: MonitoredPaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1555/003
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.003

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    TargetImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    GrantedAccess:
      - '0x1F0FFF'
      - '0x1FFFFF'

  filter_avedr:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\CSFalconService.exe'

  condition: selection and not filter_avedr

falsepositives:
  - Legitimate password-manager browser-integration agents; validate SourceImage against known-good software.

level: high

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

title: "T1555.003 Credentials from Password Stores: Credentials from Web Browsers"
id: 863d9256-5fa5-4758-b1da-8b569362bd9f
description: 'Detect Suspicious Access to Browser Credential Stores. (Retargeted: the previous rule fired on any ptrace by gdb/python3/lldb against ANY process with no requirement that the target be a browser, making it a generic "someone is debugging something" rule, and it ignored this technique''s primary vector of directly reading the browser''s credential-store files; this version primarily watches for opens of the actual Firefox/Chrome/Chromium/Edge/Brave credential and cookie databases -- key4.db, logins.json, cookies.sqlite, Login Data, Cookies -- by a process other than the browser itself, and secondarily flags gdb/lldb invocations whose own argv names a browser binary/process as the attach target.) Tune using: BrowserCredentialFiles, AllowedDebuggers.'
references:
  - https://attack.mitre.org/techniques/T1555/003
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.003

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection_browser_cred_file:
    type: PATH
    name|contains:
      - '/.mozilla/firefox/'
      - '/.config/google-chrome/'
      - '/.config/chromium/'
      - '/.config/microsoft-edge/'
      - '/.config/BraveSoftware/'
    name|endswith:
      - 'key4.db'
      - 'logins.json'
      - 'cookies.sqlite'
      - 'Login Data'
      - 'Cookies'
  filter_browser_process_itself:
    exe|contains:
      - '/firefox'
      - '/chrome'
      - '/chromium'
      - '/microsoft-edge'
      - '/brave'
  selection_ptrace_debugger:
    type: EXECVE
    a0|endswith:
      - '/gdb'
      - '/lldb'
  selection_ptrace_names_browser:
    - a1|contains: ['chrome', 'chromium', 'firefox']
    - a2|contains: ['chrome', 'chromium', 'firefox']
    - a3|contains: ['chrome', 'chromium', 'firefox']

  condition: (selection_browser_cred_file and not filter_browser_process_itself) or (selection_ptrace_debugger and selection_ptrace_names_browser)

falsepositives:
  - Browser sync/backup utilities, password-manager import tools, and forensic/IR triage scripts legitimately read the same credential-store files; developers debugging a browser process with gdb/lldb while referencing its binary path in argv for symbol resolution.

level: medium

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

title: "T1555.003 Credentials from Password Stores: Credentials from Web Browsers"
id: f4a83eba-e09f-4c31-80ff-eb7f7c85ec95
description: 'Detect Suspicious Access to Browser Credential Stores. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PrivilegedUsers, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1555/003
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.003

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/sqlite3'
      - '/python3'
    CommandLine|contains: 'Login Data'
  selection2:
    CommandLine|contains: 'Cookies.binarycookies'

  condition: 1 of selection*

falsepositives:
  - Browser sync or profile migration tools accessing the Login Data database as part of a legitimate password manager import.

level: high

Related sub-techniques

Explore