AN0037
Analytic 0037
Windows
Access to browser artifact locations (e.g., Chrome, Edge, Firefox) by processes like PowerShell, cmd.exe, or unknown tools, followed by file reads, decoding, or export operations indicating enumeration of bookmarks, autofill, or history databases.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[TargetPathRegex]
Location of browser data folders like %APPDATA%\Google\Chrome\User Data or %APPDATA%\Mozilla\Firefox
[ParentProcess]
Used to exclude known browser maintenance or backup processes
[ScriptBlockPattern]
Used to detect suspicious PowerShell commands targeting browser data
AN0038
Analytic 0038
Linux
Unauthorized shell or script-based access to browser config or SQLite history files, typically in ~/.config/google-chrome/, ~/.mozilla/, or ~/.var/app folders, indicating enumeration of bookmarks or saved credentials.
auditd:SYSCALL
open, read, or stat of browser config files
linux:syslog
Suspicious script or command execution targeting browser folders
[BrowserProfilePath]
User-specific browser data folders, e.g., ~/.config/chromium/Default/History
[ShellRegex]
Shell pattern detecting suspicious access to .sqlite or .json files
AN0039
Analytic 0039
macOS
Scripting or CLI tool access to ~/Library/Application Support/Google/Chrome or ~/Library/Safari bookmarks, cookies, or history databases. Detection relies on unexpected processes accessing or reading from these locations.
macos:unifiedlog
Access to ~/Library/*/Safari or Chrome directories by non-browser processes
macos:osquery
process reading browser configuration paths
[BrowserDBPath]
System-specific paths to browser databases in user Library folders
[NonBrowserProcessList]
Processes not expected to touch browser DBs (e.g., curl, bash, python)