MITRE ATT&CKtechnique

T1217 Browser Information Discovery

Published 2018-04-18 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Windows
Version
2.0
Created
2018-04-18

Description

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (31)

  • S9062 MiniBrowse software (malware)
  • S9050 Vidar software (malware)
  • C0060 Operation AkaiRyū campaign
  • S9010 GlassWorm software (malware)
  • S1246 BeaverTail software (malware)
  • S1240 RedLine Stealer software (malware)
  • C0057 3CX Supply Chain Attack campaign
  • S1213 Lumma Stealer software (malware)
  • S1196 Troll Stealer software (malware)
  • S1185 LightSpy software (malware)
  • C0044 Juicy Mix campaign
  • C0042 Outer Space campaign
  • G1036 Moonstone Sleet group
  • S1153 Cuckoo Stealer software (malware)
  • S1122 Mispadu software (malware)
  • G1017 Volt Typhoon group
  • G1015 Scattered Spider group
  • S1060 Mafalda software (malware)
  • S1042 SUGARDUMP software (malware)
  • S1012 PowerLess software (malware)
  • S0681 Lizar software (malware)
  • S0673 DarkWatchman software (malware)
  • S0567 Dtrack software (malware)
  • G0117 Fox Kitten group
  • G0114 Chimera group
  • S0409 Machete software (malware)
  • G0094 Kimsuky group
  • S0363 Empire software (tool)
  • G0082 APT38 group
  • S0274 Calisto software (malware)
Show all 31 ›

Referenced by CAPEC · att&ck technique (1)

References