Forensia CTI Core

About

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).

Platforms: Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

7 known groups

G0082 APT38 G0094 Kimsuky G0114 Chimera G0117 Fox Kitten G1015 Scattered Spider G1017 Volt Typhoon G1036 Moonstone Sleet

Software

18 malware/tools implement this

MobileOrderCalistoEmpireMacheteDtrackDarkWatchmanLizarPowerLessSUGARDUMPMafaldaMispaduCuckoo StealerLightSpyTroll StealerLumma StealerRedLine StealerBeaverTailGlassWorm

Corpus indicators tagged with this technique

101 indicators in the corpus carry T1217.

Indicator	Type	Family	Sev	Src
307964ed02f34bff4e40c5402cc936be07fd9957ef400596a4b3e2cd98c50ec1	sha256	—	80	1
92710bdb44279dbe8ccff34ba698d1558fa6d271c99ed4960ccbfb6d518d9418	sha256	—	80	1
1c01ab1b59245f24ebdc5d9c414fcf4e2ce31f71f181522efc5a3d27476c8e21	sha256	—	80	1
2d8e5a2763f9a899fda44390d5b8495836c11fb266a61868d52d1f397c5243ee	sha256	—	80	1
7a370a9262d37de6a24706f92ff0cdded7202281a6ff3bf313721756226ebff9	sha256	—	80	1
8bef879c6920cdce7c01b8dbb7da24dca23b8822a7aa00dfc72cb32f55879a24	sha256	—	80	1
12b41c07299d2535f7cdc194d97496acd944a9eb5d94b8d24b19291ed9d0830c	sha256	—	80	1
19e0070e5009bd5b376b9be997361d0773dcb004200ee8fafe6c14b96cbd93e4	sha256	—	80	1
1d52ded1f3838a1eee849ae20b2fee6c84b183cc98abe7244365b9f34b925eea	sha256	—	80	1
2d5615acd1b0666995fd124fb72f2713c6609b5368350340288b52fecbdd016d	sha256	—	80	1
4991873515d6dea70d7769cf67ccd8ea69184e5e454a6e6d1e093b6a3c48eb47	sha256	—	80	1
57edeb575862ce8d3bff2eb4d32d9e3fa1ffb7cb8f818e2e7fc6d25a506faea6	sha256	—	80	1
848036661c71b80ee41566918faa5eae3bf4f03ae807bb4af42cb483b6c141e2	sha256	—	80	1
88f9e169a85dcf6a1c03bf3ca1b1a262ed32baeca46cb87f0324adfdc098d4a2	sha256	—	80	1
ccca11a6d5835999c40a0a5264084b3740633600c157754fad2ef59559e31736	sha256	—	80	1
5a23ca644cb1f310be1abd5f6c6a3b3e15681ced99b0947a7f3465a79aae5089	sha256	—	80	1
a8acc24bb3e6a1a3b66a31ceaefda07d4a0e17415468683458b499f2ba240450	sha256	—	80	1
d55ce447e249ef9045750865fa196c8ca8434c8c484f861b7bdecbceeab7c16e	sha256	—	80	1
ad0f892b7b99b68491ade4949ef6b575e64d9df5f84a53019b5c1e4eeb4c46a9	sha256	—	80	1
1d699a46339626db299548e32ed3a77eec267840c3de39b49caf38b88aeb150d	sha256	—	80	1
512adab2c69feaf026adfb12cbd7d2eb4fee746120491e44f476eebddcbb19f2	sha256	—	80	1
2267d05dbd5e30c6dfcdde25731280dd755e689faa684bd21cfbef5281fd3e86	sha256	—	80	1
66bf111030a2e22db575c0b7b7b677208745eef8b44265bb4259f41f126f1bf8	sha256	—	80	1
3e17ce0b30b9fd6863b341ae58ee118dc13f2ee7f1c92ac4b81c04d54480d0e0	sha256	—	80	1
4e035575be8fe350a9e36cf29dbbc8826af2f772672bd08c9e489a243cb90e31	sha256	—	80	1
5562246e38f8935ba8b07350e6aaa44bc22abf37b77f49836fde5999f4b61cf1	sha256	—	80	1
7d8b6a64f7b65b281e7b5568929c6f96c62bbae9628162aabe7d8140a86d3de8	sha256	—	80	1
8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5	sha256	—	80	1
85816d89dac648645a9026973772815e956c267232b3d2577a06a43418f19ed3	sha256	—	80	1
a4b34b94a905fe330b0a3e4502aa45356e383a8f45ff1d008b785ea0ec14acaf	sha256	—	80	1

Showing the top 30 by severity of 101.