Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
{"T1555":"Chain with T1555 for deeper attack path","T1555.001":"Chain with T1555.001 for deeper attack path","T1555.002":"Chain with T1555.002 for deeper attack path"}
T1555.003 Credentials from Web Browsers
Sub-technique of: T1555
High-Level Description
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
Kill Chain Phase
Credential Access (TA0006)
Platforms: Linux, macOS, Windows
What to Check
Identify if Credentials from Web Browsers technique is applicable to target environment
Check Linux systems for indicators of Credentials from Web Browsers
Check macOS systems for indicators of Credentials from Web Browsers
Check Windows systems for indicators of Credentials from Web Browsers
Verify mitigations are bypassed or absent (5 known mitigations)
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Run Chrome-password Collector
A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.
Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder..\ExternalPayloads\sysinternals\passwordsdb.
Modified Sysinternals must be located at #{file_path}
Atomic Test 2: Search macOS Safari Cookies
This test uses grep to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.
Upon successful execution, MacOS shell will cd to ~/Libraries/Cookies and grep for Cookies.binarycookies.
Supported Platforms: macos
cd ~/Library/Cookies
grep -q "#{search_string}""Cookies.binarycookies"
Atomic Test 3: LaZagne - Credentials from Browser
The following Atomic test utilizes LaZagne to extract passwords from browsers on the Windows operating system.
LaZagne is an open source application used to retrieve passwords stored on a local computer.
Supported Platforms: windows
Elevation Required: Yes
"#{lazagne_path}" browsers
Dependencies:
LaZagne.exe must exist on disk at specified location (#{lazagne_path})
Atomic Test 4: Simulating access to Chrome Login Data
Simulates an adversary accessing encrypted credentials from Google Chrome Login database.
Supported Platforms: windows
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads"
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination "PathToAtomicsFolder\..\ExternalPayloads"
Dependencies:
Chrome must be installed
Atomic Test 5: Simulating access to Opera Login Data
Simulates an adversary accessing encrypted credentials from Opera web browser's login database.
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Credentials from Web Browsers by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1555.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1051 Update Software
Regularly update web browsers, password managers, and all related software to the latest versions. Keeping software up-to-date reduces the risk of vulnerabilities being exploited by attackers to extract stored credentials or session cookies.
M1018 User Account Management
Implement strict user account management policies to prevent unnecessary accounts from accessing sensitive systems. Regularly audit user accounts to identify and disable inactive accounts that may be targeted by attackers to extract credentials or gain unauthorized access.
M1017 User Training
Provide user training on secure practices for managing credentials, including avoiding storing sensitive passwords in browsers and using password managers securely. Users should also be educated on identifying phishing attempts that could steal session cookies or credentials.
M1021 Restrict Web-Based Content
Restrict or block web-based content that could be used to extract session cookies or credentials stored in browsers. Use browser security settings, such as disabling third-party cookies and restricting browser extensions, to limit the attack surface.
M1027 Password Policies
Organizations may consider weighing the risk of storing credentials in web browsers. If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers.
Detection
Detect Suspicious Access to Browser Credential Stores
Risk Assessment
Finding
Severity
Impact
Credentials from Web Browsers technique applicable
