Command line naming a browser login-credential store

Siemphony@siemphonyhighT1555.003unverified

AN0105's copy-and-carry leg: a process created with a browser login-credential database named on its command line — Chrome/Chromium's `Login Data` SQLite file, Firefox's `logins.json`, and the `key4.db` NSS key store Firefox needs to decrypt those logins. This is deliberately the same shape as the published T1539 rule for browser session cookies, but a disjoint file set: Login Data, logins.json and key4.db hold usernames and passwords, never the session tokens T1539 keys on, so the two rules alert on different theft techniques even when the same stealer tooling triggers both in one run. AN0105's other legs — a correlated `CryptUnprotectData` API call or a Sysmon EventID 10 process-access read of the browser's memory — are separate events from process creation and are not expressed here; a stealer that reads the file through the Win32 API or inspects browser memory directly writes no command line at all and this rule will not see it. Security 4688 is off by default and needs Audit Process Creation, plus the separate Include command line in process creation events policy for CommandLine to be populated — without both, this rule returns nothing because nothing is being collected. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0037, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "\\Login Data" or ProcessCommandLine contains "logins.json" or ProcessCommandLine contains "key4.db")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*\\Login Data*" OR CommandLine="*logins.json*" OR CommandLine="*key4.db*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*\\\\login data*" OR TO_LOWER(process.command_line) LIKE "*logins.json*" OR TO_LOWER(process.command_line) LIKE "*key4.db*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\\Login Data|logins\.json|key4\.db)</field>    <description>Command line naming a browser login-credential store</description>    <mitre>      <id>T1555.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: browser_credential_theft
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8cace3cd-7371-4165-bd5e-833c92180b2f

ATT&CKT1555.003

T1555.003Credentials from Web Browsers

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

AN0105's Windows analytic wants file access to a browser credential store correlated with a CryptUnprotectData API call or memory inspection. This rule authors only the "copy-and-carry" half: a process created with one of three credential-store paths on its own command line — Chrome/Chromium's Login Data SQLite file, Firefox's logins.json, and the key4.db NSS key store Firefox needs to decrypt those logins.

02 · Telemetry you need

Sysmon EventID 1, or Security 4688 with Audit Process Creation and the separate Include command line in process creation events policy — neither is on by default, and without both this rule returns nothing while looking like a quiet environment rather than an unaudited one.

03 · How the logic works

One unanchored OR across three literal substrings, all on CommandLine, nothing checked on Image — any process that types one of these paths as an argument matches, which is deliberate: a stealer, a backup tool and a migration utility all look identical at this level. The rule is scoped against its published sibling for T1539: same shape, disjoint file set. Login Data, logins.json and key4.db hold usernames and passwords; T1539's rule keys on session-cookie stores. The two alert on different theft techniques even when one stealer run triggers both. What AN0105 does not get here is the correlated API leg — a stealer that reads these files through the raw Win32 file API, or inspects browser process memory directly (the Sysmon EventID 10 leg), writes no command line at all and is invisible to this selector.

04 · Common false positives

Four false positives are listed, and the reviewer accepted three outright: password-manager or browser-migration tools a user runs deliberately, IR/forensic tooling reading the same files for legitimate investigation, and roaming-profile/VDI logoff scripts clearing a corrupted store on a predictable schedule. The fourth — backup/DLP agents "that walk the user profile by absolute path" — drew a caveat: many enterprise backup and DLP suites enumerate files through a filesystem filter driver or API rather than spawning a per-file process with the path as an argument, so this entry may overstate how often it actually fires as worded.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0037 and never executed against logs. level: high is defensible as written: unlike sibling rules in the same review batch, no single false positive here is described as the dominant source. Coverage is Windows-only — AN0106 (Linux, auditd file watch on logins.json/Login Data plus ptrace attach) and AN0107 (macOS, Unified Log execution of security/sqlite3) are untouched.
tier_2: means confirming the backup/DLP false-positive rate against real telemetry;
tier_3: means adding the CryptUnprotectData/Sysmon 10 correlation leg.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Narrow the backup/DLP false positive to script-based or CLI-driven tooling
MITRE's MonitoredPaths knob is what's populated above; its TimeWindow
Parent-process allowlisting (the known backup agent, the known migration

Declared by the author

Backup, endpoint-DLP and profile-migration agents that walk the user profile by absolute path. When one of them names Login Data or logins.json on its command line the event is byte-for-byte what a stealer produces, and only the parent process and the schedule tell them apart.
Browser import/export utilities and password-manager migration tools that a user runs deliberately to move saved logins from one browser to another, which put the source browser's Login Data or logins.json path directly on the command line as an argument.
Forensic and incident-response tooling run by the security team itself, which reads the same files for entirely legitimate reasons and is a likely source of the first hits this rule ever produces in an environment with an active IR function.
Roaming-profile and VDI logoff scripts that clear or reset a corrupted credential store as part of routine profile teardown, recurring at predictable times across the whole estate rather than on a single suspicious host.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1555.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/8cace3cd-7371-4165-bd5e-833c92180b2f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Command line naming a browser login-credential store

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it