Browser profile artefact named on a non-browser command line

Siemphony@siemphonymediumT1217unverified

AN0037's process-creation leg: a shell, copy or extraction utility created with a browser profile location on its command line — the Chromium-family `User Data` trees for Chrome, Edge, Brave, Chromium and Opera, the Firefox `Profiles` directory, and the Firefox history and autofill databases places.sqlite and formhistory.sqlite. That path set is MITRE's `TargetPathRegex` knob, populated here with the default per-browser layouts; a site that redirects profiles onto a network share must add its own path. The image gate is not optional decoration. Chrome, Edge and every one of their renderer, GPU and utility child processes carry `--user-data-dir=…` pointing at the profile on their own command lines, so a path-only rule of the shape used for T1539 and T1555.003 would match thousands of times an hour per host and match the browser itself almost every time. Anchoring on a non-browser tool is what makes the path meaningful, and it is also this rule's main limit: an implant that opens the History or Web Data SQLite file through its own code writes no command line at all and is invisible here. Overlap with the published T1539 and T1555.003 rules is real and worth knowing before you triage. Those two key on Cookies, Login Data, logins.json and key4.db; the Firefox entries here (places.sqlite, formhistory.sqlite) are disjoint from them, but the Chromium entries are directory prefixes, so a command line naming `…\Google\Chrome\User Data\Default\Login Data` satisfies this rule as well as the credential-access one. Treat a lone T1217 hit as discovery and a simultaneous T1539 or T1555.003 hit as the stronger claim. Not attempted here: AN0037's PowerShell leg, since 4103/4104 is a separate logsource needing its own rule and its own Script Block Logging prerequisite, and its Sysmon EventID 11 leg, which sees the export file being written rather than the browser data being read. The Linux and macOS arms AN0038 and AN0039 are separate logsources as well. Prerequisite: the brief maps this to Sysmon EventID 1, so the fields are Sysmon's and the rule is blind unless Sysmon is installed and its configuration does not exclude these images; on a Security 4688 feed the field names must be remapped to NewProcessName, and CommandLine there needs the separate Include command line in process creation events policy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0013, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "\\Google\\Chrome\\User Data" or ProcessCommandLine contains "\\Microsoft\\Edge\\User Data" or ProcessCommandLine contains "\\BraveSoftware\\Brave-Browser\\User Data" or ProcessCommandLine contains "\\Chromium\\User Data" or ProcessCommandLine contains "\\Mozilla\\Firefox\\Profiles" or ProcessCommandLine contains "\\Opera Software\\Opera Stable" or ProcessCommandLine contains "places.sqlite" or ProcessCommandLine contains "formhistory.sqlite") and (FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\findstr.exe" or FolderPath endswith "\\xcopy.exe" or FolderPath endswith "\\robocopy.exe" or FolderPath endswith "\\tar.exe" or FolderPath endswith "\\esentutl.exe" or FolderPath endswith "\\certutil.exe" or FolderPath endswith "\\sqlite3.exe" or FolderPath endswith "\\7z.exe"))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*\\Google\\Chrome\\User Data*" OR CommandLine="*\\Microsoft\\Edge\\User Data*" OR CommandLine="*\\BraveSoftware\\Brave-Browser\\User Data*" OR CommandLine="*\\Chromium\\User Data*" OR CommandLine="*\\Mozilla\\Firefox\\Profiles*" OR CommandLine="*\\Opera Software\\Opera Stable*" OR CommandLine="*places.sqlite*" OR CommandLine="*formhistory.sqlite*") AND (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\findstr.exe" OR Image="*\\xcopy.exe" OR Image="*\\robocopy.exe" OR Image="*\\tar.exe" OR Image="*\\esentutl.exe" OR Image="*\\certutil.exe" OR Image="*\\sqlite3.exe" OR Image="*\\7z.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*\\\\google\\\\chrome\\\\user data*" OR TO_LOWER(process.command_line) LIKE "*\\\\microsoft\\\\edge\\\\user data*" OR TO_LOWER(process.command_line) LIKE "*\\\\bravesoftware\\\\brave-browser\\\\user data*" OR TO_LOWER(process.command_line) LIKE "*\\\\chromium\\\\user data*" OR TO_LOWER(process.command_line) LIKE "*\\\\mozilla\\\\firefox\\\\profiles*" OR TO_LOWER(process.command_line) LIKE "*\\\\opera software\\\\opera stable*" OR TO_LOWER(process.command_line) LIKE "*places.sqlite*" OR TO_LOWER(process.command_line) LIKE "*formhistory.sqlite*") AND (TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\findstr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\xcopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\robocopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\esentutl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sqlite3.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7z.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\\Google\\Chrome\\User Data|\\Microsoft\\Edge\\User Data|\\BraveSoftware\\Brave-Browser\\User Data|\\Chromium\\User Data|\\Mozilla\\Firefox\\Profiles|\\Opera Software\\Opera Stable|places\.sqlite|formhistory\.sqlite)</field>    <field name="Image" type="pcre2">(?i)(\\cmd\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\findstr\.exe$|\\xcopy\.exe$|\\robocopy\.exe$|\\tar\.exe$|\\esentutl\.exe$|\\certutil\.exe$|\\sqlite3\.exe$|\\7z\.exe$)</field>    <description>Browser profile artefact named on a non-browser command line</description>    <mitre>      <id>T1217</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c315ea78-5959-40b0-ad60-bdfaa041f19f

ATT&CKT1217

T1217Browser Information Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

AN0037's process-creation leg. The rule fires when a shell, copy or extraction utility is created with a browser profile location on its command line — the Chromium-family User Data trees for Chrome, Edge, Brave, Chromium and Opera, the Firefox Profiles directory, and the Firefox history and autofill databases places.sqlite and formhistory.sqlite. It is the enumeration step: someone reaching into a browser profile with a general-purpose tool rather than with the browser.

02 · Telemetry you need

category: process_creation, product: windows, which the brief maps to Sysmon EventID 1, so the fields are Sysmon's. The rule is blind unless Sysmon is installed and its configuration does not exclude these images. On a Security 4688 feed, Image must be remapped to NewProcessName, and CommandLine there requires the separate Include command line in process creation events policy — without it the path selection has nothing to read and the rule silently returns nothing.

03 · How the logic works

That path set is MITRE's TargetPathRegex knob, populated here with the default per-browser layouts — the specific eight entries are the pipeline's, not MITRE's. A site that redirects profiles onto a network share must add its own path. The image gate is not decoration. Chrome, Edge and every one of their renderer, GPU and utility child processes carry --user-data-dir=… on their own command lines, so a path-only rule would match thousands of times an hour per host and match the browser itself almost every time. Anchoring on a non-browser tool is what makes the path meaningful — and it is also the main limit: an implant that opens History or Web Data through its own SQLite code writes no command line and is invisible here. Overlap matters at triage. The published T1539 and T1555.003 rules key on Cookies, Login Data, logins.json and key4.db. The Firefox entries here are genuinely disjoint from those, but the Chromium entries are directory prefixes, so a command line naming …\Google\Chrome\User Data\Default\Login Data satisfies this rule and the credential-access one. Treat a lone T1217 hit as discovery and a simultaneous T1539 or T1555.003 hit as the stronger claim.

04 · Common false positives

Backup, endpoint-DLP and profile-sync agents that shell out to robocopy or xcopy across the user profile are the steadiest source: wherever profile backup is on, this recurs on every host at the same time each day. Helpdesk and migration work supplies the rest — copying a User Data folder to a replacement machine, exporting bookmarks, moving a corrupt Firefox profile aside so the browser rebuilds it. Browser rollout scripts seed policy files and extension lists into the User Data tree at logon. Selenium, Playwright and Puppeteer harnesses on build hosts create and seed profiles before every run.

05 · Detection maturity

tier_1: , until it has been run against real data. UNVERIFIED — derived from DET0013 and never executed against logs. AN0037's PowerShell 4103/4104 leg and its Sysmon EventID 11 leg are unwritten, as are the Linux and macOS arms AN0038 and AN0039.
tier_2: begins by measuring the backup-agent volume on one real estate and excluding it by parent.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by parent process, which is MITRE's ParentProcess knob: the backup agent, the deployment agent and the test runner each have a stable parent, and excluding those is far safer than dropping robocopy.exe from the tool list. Then look at what the command line does with the path — a read into a staging directory or an archive is the interesting shape; a write into the profile is usually configuration.

Declared by the author

Helpdesk and profile-migration work: the cmd or PowerShell one-liners used to copy a User Data folder to a replacement machine, export a user's bookmarks, or move a corrupt Firefox profile aside so the browser will rebuild it.
Backup, endpoint-DLP and profile-sync agents that shell out to robocopy or xcopy across the user profile on a fixed schedule. Wherever profile backup is enabled this recurs on every host at the same time each day and should be excluded by parent process before the rule's volume means anything.
Browser rollout and configuration scripts run at logon or by the software-deployment agent, which seed a policy file, preferences or an extension list into the User Data tree on managed machines.
Browser test automation — Selenium, Playwright and Puppeteer harnesses on developer and build hosts — where a cmd.exe or PowerShell wrapper creates or seeds a profile directory before each run.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1217, evaluated against their process_creation events.

Share this rule

/u/siemphony/c315ea78-5959-40b0-ad60-bdfaa041f19f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Browser profile artefact named on a non-browser command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it