Unusual process accessed web browser credentials

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Credentials Grabbing Analytics
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
Severity	Informational

An unusual process has accessed a web browser credentials file.

Obtain access to credentials (such as cached logins) stored in the web browser.

Determine whether it is legitimate for the process to access web browser credential data directly.
Analyze the process/application that accessed the credentials.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials cached in the web browser.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
Severity	High

An unusual process has accessed a web browser credentials file.

Obtain access to credentials (such as cached logins) stored in the web browser.

Determine whether it is legitimate for the process to access web browser credential data directly.
Analyze the process/application that accessed the credentials.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials cached in the web browser.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Credentials from Password Stores: Credentials from Web Browsers (T1555.003)
Severity	Low

An unusual process has accessed a web browser credentials file.

Obtain access to credentials (such as cached logins) stored in the web browser.

Determine whether it is legitimate for the process to access web browser credential data directly.
Analyze the process/application that accessed the credentials.
Check for any other suspicious actions that were performed by the process.
Look for unusual access to resources using credentials cached in the web browser.