t1217-browser-information-discovery

name	T1217_browser-information-discovery
description	Adversaries may enumerate information about browsers to learn more about compromised environments.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1217","discovery","linux","macos","windows"]
technique_id	T1217
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1217
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1217 Browser Information Discovery

High-Level Description

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser.

Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., %APPDATA%/Google/Chrome).

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Browser Information Discovery technique is applicable to target environment
• Check Linux systems for indicators of Browser Information Discovery
• Check macOS systems for indicators of Browser Information Discovery
• Check Windows systems for indicators of Browser Information Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: List Mozilla Firefox Bookmark Database Files on FreeBSD/Linux

Searches for Mozilla Firefox's places.sqlite file (on FreeBSD or Linux distributions) that contains bookmarks and lists any found instances to a text file.

Supported Platforms: linux

find / -path "*.mozilla/firefox/*/places.sqlite" 2>/dev/null -exec echo {} >> #{output_file} \;
cat #{output_file} 2>/dev/null

Atomic Test 2: List Mozilla Firefox Bookmark Database Files on macOS

Searches for Mozilla Firefox's places.sqlite file (on macOS) that contains bookmarks and lists any found instances to a text file.