T1217 Browser Information Discovery

Technique

T1217

Tactics

Discovery

Research, 90 days

6

KEV CVEs mapped

1

SigmaHQ rules

4

Elastic, Splunk

0

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1217

MITRE description

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2020-3580

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 ESET: Gorbag: Orcs at the border harvesting intelligence from Ukraine
• 2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware
• 2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
• 2026-09-14 Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit
• 2026-09-03 Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
• 2026-08-31 Group-IB: Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Detection coverage

SigmaHQ community rules

• Suspicious File Access to Browser Credential Storage (core)
• Automated Collection Bookmarks Using Get-ChildItem PowerShell (core)
• File And SubFolder Enumeration Via Dir Command (core)
• Suspicious Where Execution (core)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.