T1555.003 Credentials from Web Browsers — Detection Rules

Detection workspace for T1555.003 Credentials from Web Browsers: 7 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

Suspicious File Access to Browser Credential Storage · experimental · low · {"category":"file_access","product":"windows"}
Access to Browser Login Data · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
HackTool - WinPwn Execution - ScriptBlock · test · high · {"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"}
HackTool - WinPwn Execution · test · high · {"category":"process_creation","product":"windows"}
PUA - WebBrowserPassView Execution · test · medium · {"category":"process_creation","product":"windows"}
SQLite Chromium Profile Data DB Access · test · high · {"category":"process_creation","product":"windows"}
Potential Browser Data Stealing · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0037 Detect Suspicious Access to Browser Credential Stores

AN0105 Analytic 0105

Detects unauthorized access to web browser credential stores (e.g., Chrome Login Data, Edge Credential Locker) by processes other than the browser itself. Correlates file reads of credential databases with subsequent API calls to `CryptUnprotectData` or memory inspection attempts.

AN0106 Analytic 0106

Detects attempts to access browser credential stores (e.g., Firefox `logins.json`, Chrome SQLite DB) or processes (e.g., gnome-keyring-daemon). Observes unauthorized file reads and memory inspection of browser processes using ptrace or gdb.

AN0107 Analytic 0107

Detects abnormal access to Safari credential stores (Keychain-backed) or Chrome/Firefox login databases. Observes processes executing `security dump-keychain` or directly reading credential files in `~/Library/Application Support`. Correlates file access with suspicious process ancestry or unsigned binaries.

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1555.003 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.