{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1217","id":"T1217","name":"Browser Information Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1217","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"c1553b135734b9e1a8f412a6cc53b6d202ee3910658f3acaa16f5219278b0122","description":"Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill)\n\nBrowser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser.\n\nSpecific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1217","external_id":"T1217"},{"source_name":"Chrome Roaming Profiles","description":"Chrome Enterprise and Education Help. (n.d.). Use Chrome Browser with Roaming User Profiles. Retrieved March 28, 2023.","url":"https://support.google.com/chrome/a/answer/7349337"},{"source_name":"Kaspersky Autofill","description":"Golubev, S. (n.d.). How malware steals autofill data from browsers. Retrieved March 28, 2023.","url":"https://www.kaspersky.com/blog/browser-data-theft/27871/"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1217","id":"T1217","name":"Browser Information Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1217","technique_page":"techniques/enterprise/T1217/","page":"detections/enterprise/T1217/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"a1dfd976-4852-41d4-9507-dc6590a3ccd0","title":"Suspicious File Access to Browser Credential Storage","status":"experimental","level":"low","logsource":{"category":"file_access","product":"windows"},"data_path":"data/detection-rules/a1dfd976-4852-41d4-9507-dc6590a3ccd0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml","author":"frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore","kind":"sigma"},{"id":"e0565f5d-d420-4e02-8a68-ac00d864f9cf","title":"Automated Collection Bookmarks Using Get-ChildItem PowerShell","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/e0565f5d-d420-4e02-8a68-ac00d864f9cf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml","author":"frack113","kind":"sigma"},{"id":"7c9340a9-e2ee-4e43-94c5-c54ebbea1006","title":"File And SubFolder Enumeration Via Dir Command","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7c9340a9-e2ee-4e43-94c5-c54ebbea1006.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml","author":"frack113","kind":"sigma"},{"id":"725a9768-0f5e-4cb3-aec2-bc5719c6831a","title":"Suspicious Where Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/725a9768-0f5e-4cb3-aec2-bc5719c6831a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_where_browser_data_recon.yml","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0013","name":"Detection of Local Browser Artifact Access for Reconnaissance","url":"https://attack.mitre.org/detectionstrategies/DET0013","stix_id":"x-mitre-detection-strategy--3e5e2bda-40c0-4aea-90f1-8fc52096ad5e","relationship_id":"relationship--48832f2d-d088-4d32-b41d-b15030559f96","description":"","analytics":[{"id":"AN0037","name":"Analytic 0037","guidance":"Access to browser artifact locations (e.g., Chrome, Edge, Firefox) by processes like PowerShell, cmd.exe, or unknown tools, followed by file reads, decoding, or export operations indicating enumeration of bookmarks, autofill, or history databases.","url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0037","platforms":["Windows"],"tuning":[{"field":"TargetPathRegex","description":"Location of browser data folders like %APPDATA%\\Google\\Chrome\\User Data or %APPDATA%\\Mozilla\\Firefox"},{"field":"ParentProcess","description":"Used to exclude known browser maintenance or backup processes"},{"field":"ScriptBlockPattern","description":"Used to detect suspicious PowerShell commands targeting browser data"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0037","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0037","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN0037","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0037","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0037","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0037","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0038","name":"Analytic 0038","guidance":"Unauthorized shell or script-based access to browser config or SQLite history files, typically in ~/.config/google-chrome/, ~/.mozilla/, or ~/.var/app folders, indicating enumeration of bookmarks or saved credentials.","url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0038","platforms":["Linux"],"tuning":[{"field":"BrowserProfilePath","description":"User-specific browser data folders, e.g., ~/.config/chromium/Default/History"},{"field":"ShellRegex","description":"Shell pattern detecting suspicious access to .sqlite or .json files"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open, read, or stat of browser config files","platforms":["Linux"],"analytic_id":"AN0038","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0038","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0064","component":"Command Execution","name":"linux:syslog","channel":"Suspicious script or command execution targeting browser folders","platforms":["Linux"],"analytic_id":"AN0038","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0038","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN0039","name":"Analytic 0039","guidance":"Scripting or CLI tool access to ~/Library/Application Support/Google/Chrome or ~/Library/Safari bookmarks, cookies, or history databases. Detection relies on unexpected processes accessing or reading from these locations.","url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0039","platforms":["macOS"],"tuning":[{"field":"BrowserDBPath","description":"System-specific paths to browser databases in user Library folders"},{"field":"NonBrowserProcessList","description":"Processes not expected to touch browser DBs (e.g., curl, bash, python)"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"macos:unifiedlog","channel":"Access to ~/Library/*/Safari or Chrome directories by non-browser processes","platforms":["macOS"],"analytic_id":"AN0039","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0039","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"process reading browser configuration paths","platforms":["macOS"],"analytic_id":"AN0039","source_url":"https://attack.mitre.org/detectionstrategies/DET0013#AN0039","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0079","name":"MobileOrder","url":"https://attack.mitre.org/software/S0079","kind":"malware","description":"[MobileOrder](https://attack.mitre.org/software/S0079) has a command to upload to its C2 server victim browser bookmarks.(Citation: Scarlet Mimic Jan 2016)","relationship_id":"relationship--c8786a8c-9c40-4df3-874f-952b814baec9","references":[{"source_name":"Scarlet Mimic Jan 2016","description":"Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}]},{"id":"S0274","name":"Calisto","url":"https://attack.mitre.org/software/S0274","kind":"malware","description":"[Calisto](https://attack.mitre.org/software/S0274) collects information on bookmarks from Google Chrome.(Citation: Securelist Calisto July 2018)","relationship_id":"relationship--0fd71bed-d22f-44f8-aef2-4c5e55aca422","references":[{"source_name":"Securelist Calisto July 2018","description":"Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.","url":"https://securelist.com/calisto-trojan-for-macos/86543/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) has the ability to gather browser data such as bookmarks and visited sites.(Citation: Github PowerShell Empire)","relationship_id":"relationship--88427fdf-9d70-49d2-a7ca-4c79ee387d3d","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.(Citation: ESET Machete July 2019) ","relationship_id":"relationship--334ae43c-2c0b-4a7a-aab5-6ff59005dbf5","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567) can retrieve browser history.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)","relationship_id":"relationship--4b83387a-bba5-44a9-9dc4-3aae9a916d24","references":[{"source_name":"Securelist Dtrack","description":"Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","description":"Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can retrieve browser history.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--7e160715-2735-4d96-8918-14036c2804a7","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) can retrieve browser history and database files.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021) ","relationship_id":"relationship--1be14720-a61a-4ac6-a6f6-f84c74c60d43","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"Threatpost Lizar May 2021","description":"Seals, T. (2021, May 14). FIN7 Backdoor Masquerades as Ethical Hacking Tool. Retrieved February 2, 2022.","url":"https://threatpost.com/fin7-backdoor-ethical-hacking-tool/166194/"}]},{"id":"S1012","name":"PowerLess","url":"https://attack.mitre.org/software/S1012","kind":"malware","description":"[PowerLess](https://attack.mitre.org/software/S1012) has a browser info stealer module that can read Chrome and Edge browser database files.(Citation: Cybereason PowerLess February 2022)","relationship_id":"relationship--4a4ff6a4-c6b1-4bb4-87f4-c28059c7dd39","references":[{"source_name":"Cybereason PowerLess February 2022","description":"Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022.","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}]},{"id":"S1042","name":"SUGARDUMP","url":"https://attack.mitre.org/software/S1042","kind":"malware","description":"[SUGARDUMP](https://attack.mitre.org/software/S1042) has collected browser bookmark and history information.(Citation: Mandiant UNC3890 Aug 2022)","relationship_id":"relationship--a0020049-7688-4c0a-8844-dece3bed614c","references":[{"source_name":"Mandiant UNC3890 Aug 2022","description":"Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can collect the contents of the `%USERPROFILE%\\AppData\\Local\\Google\\Chrome\\User Data\\LocalState` file.(Citation: SentinelLabs Metador Sept 2022) ","relationship_id":"relationship--87590696-bf1c-4d42-8ef7-851fb10d8053","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.(Citation: Segurança Informática URSA Sophisticated Loader 2020)(Citation: SCILabs Malteiro 2021)","relationship_id":"relationship--42781435-078d-4aad-add9-d70fb5f13bfe","references":[{"source_name":"Segurança Informática URSA Sophisticated Loader 2020","description":"Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.","url":"https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/"},{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can collect bookmarks, cookies, and history from Safari.(Citation: Kandji Cuckoo April 2024)","relationship_id":"relationship--fcb54b68-a92c-49c8-a021-c9e0ef1a402c","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"To collect data on the host's Wi-Fi connection history, [LightSpy](https://attack.mitre.org/software/S1185) reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` file. It also utilizes Apple's `CWWiFiClient` API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--8d7094e1-4617-457a-8ecb-e60c2d581f7a","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S1196","name":"Troll Stealer","url":"https://attack.mitre.org/software/S1196","kind":"malware","description":"[Troll Stealer](https://attack.mitre.org/software/S1196) collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--ba8ceccd-5406-418b-9f10-ed333e5f1e9c","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has identified and gathered information from two-factor authentication extensions for multiple browsers.(Citation: Cybereason LumaStealer Undated)","relationship_id":"relationship--d86d22e4-87ca-4039-8a36-2708f68704e6","references":[{"source_name":"Cybereason LumaStealer Undated","description":"Cybereaon Security Services Team. (n.d.). Your Data Is Under New Lummanagement: The Rise of LummaStealer. Retrieved March 22, 2025.","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) can collect information from browsers and browser extensions.(Citation: Splunk RedLine Stealer June 2023)","relationship_id":"relationship--9cf53303-770b-4de2-bbf2-3d79d5432f93","references":[{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}]},{"id":"S1246","name":"BeaverTail","url":"https://attack.mitre.org/software/S1246","kind":"malware","description":"[BeaverTail](https://attack.mitre.org/software/S1246) has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)","relationship_id":"relationship--4a37d414-b97a-4216-bab7-dfd8417a3508","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","description":"Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","description":"Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has searched browser data for cookies, history, login databases, and cryptocurrency wallets.(Citation: Socket GlassWorm January 2026)","relationship_id":"relationship--ae256211-86ed-4587-adcf-3311aa8505be","references":[{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has collected browser history from the victim machine.(Citation: QuorumCyber_Vidar_March2023)(Citation: Logpoint_StealerMalwareFamilies_2024)\n","relationship_id":"relationship--de740ec2-5915-42c6-81de-9b308ccdab84","references":[{"source_name":"Logpoint_StealerMalwareFamilies_2024","description":"Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"},{"source_name":"QuorumCyber_Vidar_March2023","description":"Quorum Cyber. (n.d.). Malware Analysis Report Vidar - Stealerware. Retrieved August 28, 2026.","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}]},{"id":"S9062","name":"MiniBrowse","url":"https://attack.mitre.org/software/S9062","kind":"malware","description":"[MiniBrowse](https://attack.mitre.org/software/S9062) has gathered browser data to include Edge login data.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)","relationship_id":"relationship--953d92ff-9f7a-4f50-bfe6-848ea4791dfc","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]}],"actors":[{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.(Citation: CISA AA20-239A BeagleBoyz August 2020) [APT38](https://attack.mitre.org/groups/G0082) has also used malware capable of enumerating 166 unique cryptocurrency wallets, browser extensions, and browser history.(Citation: MIcrosoft Mastra npm Compromise JUN 2026)","relationship_id":"relationship--658f822e-f11c-4c36-8097-8dd21f45b42e","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","description":"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has collected sensitive browser data using the function `GetBrowserData()` to include login credentials, bookmarks, cookies, and encryption keys.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--2b569111-149c-47dc-89ff-ef8a24884523","references":[{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used <code>type \\\\<hostname>\\c$\\Users\\<username>\\Favorites\\Links\\Bookmarks bar\\Imported From IE\\*citrix*</code> for bookmark discovery.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--f01bad7e-e96c-43fe-8ac9-63c4863e8c76","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used Google Chrome bookmarks to identify internal resources and assets.(Citation: CISA AA20-259A Iran-Based Actor September 2020)","relationship_id":"relationship--52ecf0cd-4e5f-4331-b4d8-42618f155c5c","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) retrieves browser histories via infostealer malware such as Raccoon Stealer.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--c0f7db5b-a4cf-40b1-b581-2ae548ca6303","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has targeted the browsing history of network administrators.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--64e03a61-21a6-40d6-9c87-30c1f21ba899","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) deployed malware such as YouieLoader capable of capturing victim system browser information.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--eeea996c-6eaf-4244-b5a8-294df9c008c3","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]}],"mitigations":[],"candidates":[{"id":"1ca1f9c7-44bc-46bb-8c85-c50e2e94267b","name":"List Mozilla Firefox Bookmark Database Files on macOS","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Mozilla Firefox's places.sqlite file (on macOS) that contains bookmarks and lists any found instances to a text file.\n","inputs":{"output_file":{"description":"Path where captured results will be placed.","type":"path","default":"/tmp/T1217_Firefox.txt"}},"dependencies":[],"source_definition_sha256":"9bb203f2d3634398f2d3591772fa7b610c70966d140970fc11cf10ab53a9863e"},{"id":"3a41f169-a5ab-407f-9269-abafdb5da6c2","name":"List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Mozilla Firefox's places.sqlite file (on FreeBSD or Linux distributions) that contains bookmarks and lists any found instances to a text file.\n","inputs":{"output_file":{"description":"Path where captured results will be placed.","type":"path","default":"/tmp/T1217-Firefox.txt"}},"dependencies":[],"source_definition_sha256":"7e600efa97ba4e89b3f9c3c458c39a8329664ce3cc1b6aab17f84530a44f400f"},{"id":"4312cdbc-79fc-4a9c-becc-53d49c734bc5","name":"List Mozilla Firefox bookmarks on Windows with command prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Mozilla Firefox bookmarks file (on Windows distributions) that contains bookmarks in a SQLITE database.\nUpon execution, paths that contain bookmark files will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"40a3dcd10a8f7a3fa5bc8ecd2dc500902bce8b723368a9f1a20aa0218f8b5da5"},{"id":"5fc528dd-79de-47f5-8188-25572b7fafe0","name":"List Safari Bookmarks on MacOS","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"This test searches for Safari's Bookmarks file (on macOS) and lists any found instances to a text file.\n","inputs":{"output_file":{"description":"Path where captured results will be placed.","type":"path","default":"/tmp/T1217-Safari.txt"}},"dependencies":[],"source_definition_sha256":"369dbbbb1a52aa3f51088a631611660320b59d4d71a47682d09a2ffc351a6516"},{"id":"727dbcdb-e495-4ab1-a6c4-80c7f77aef85","name":"List Internet Explorer Bookmarks using the command prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"This test will list the bookmarks for Internet Explorer that are found in the Favorites folder","inputs":{},"dependencies":[],"source_definition_sha256":"606d0539083670a7a20737233c988303cd12f6f23a3619fc047b395a22066d78"},{"id":"74094120-e1f5-47c9-b162-a418a0f624d5","name":"Extract Edge Browsing History","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"This test will extract Microsoft Edge browser's history of current user\n","inputs":{"history_path":{"description":"Microsoft Edge browser history file path","type":"String","default":"$Env:LOCALAPPDATA\\Microsoft\\Edge\\User Data\\Default\\History"},"dest_path":{"description":"Target file path to where the history to be extracted","type":"String","default":"$Env:USERPROFILE\\Downloads\\edgebrowsinghistory.txt"}},"dependencies":[],"source_definition_sha256":"928eff86f8c732ccfd1bd191171eebffe477a7e0eddeabc1182214c772ceb032"},{"id":"76f71e2f-480e-4bed-b61e-398fe17499d5","name":"List Google Chrome / Edge Chromium Bookmarks on Windows with command prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Google Chromes's and Edge Chromium's Bookmarks file (on Windows distributions) that contains bookmarks.\nUpon execution, paths that contain bookmark files will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8d7675021fd9b05b6ee9275395cffe727e5fbfe299cbdcb093c02ebc31fb22dc"},{"id":"88ca025b-3040-44eb-9168-bd8af22b82fa","name":"List Google Chromium Bookmark JSON Files on FreeBSD","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Google Chromium's Bookmark file (on FreeBSD) that contains bookmarks in JSON format and lists any found instances to a text file.\n","inputs":{"output_file":{"description":"Path where captured results will be placed.","type":"path","default":"/tmp/T1217-Chrome.txt"}},"dependencies":[],"source_definition_sha256":"fb6f40101a9592435d2bb216f88c4b1512153448fb7f2b50e414b9aba20ad0d4"},{"id":"b789d341-154b-4a42-a071-9111588be9bc","name":"List Google Chrome Bookmark JSON Files on macOS","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Google Chrome's Bookmark file (on macOS) that contains bookmarks in JSON format and lists any found instances to a text file.\n","inputs":{"output_file":{"description":"Path where captured results will be placed.","type":"path","default":"/tmp/T1217-Chrome.txt"}},"dependencies":[],"source_definition_sha256":"8f73bb5926d041221a88b7308e371313751a7dd4c965ba85cf7ce0f61483fc08"},{"id":"cfe6315c-4945-40f7-b5a4-48f7af2262af","name":"Extract chrome Browsing History","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"This test will extract browsing history of the chrome user\n","inputs":{},"dependencies":[],"source_definition_sha256":"9aba660b4f1b6efc415c6627d10aa2b44d6fefdb5f871ca1be3c619238ddd76a"},{"id":"faab755e-4299-48ec-8202-fc7885eb6545","name":"List Google Chrome / Opera Bookmarks on Windows with powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1217/T1217.yaml","description":"Searches for Google Chrome's and Opera's Bookmarks file (on Windows distributions) that contains bookmarks.\nUpon execution, paths that contain bookmark files will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"d3f9e643f79e5970e69712fa4184bfafb543078b436a37aefa001968856a6d7c"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1552.001":"/ttp-simulation/techniques/enterprise/T1552.001/","T1217":"/ttp-simulation/techniques/enterprise/T1217/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1217","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}