An administrator's browser is a map of the organisation: bookmarks and history list the identity provider tenant, the SaaS admin consoles, the hypervisor manager and the firewall GUI, and Browser Information Discovery (T1217) is the technique adversaries use to read that map. ATT&CK v20 lists T1217 under Discovery (TA0007) on Windows, Linux and macOS, with procedure examples from Volt Typhoon, Fox Kitten, Chimera, Kimsuky and Scattered Spider and from infostealer families such as RedLine and Lumma. This page is for detection engineers, endpoint teams and identity owners: what browser data reveals, the real cases, which telemetry ATT&CK v20 points to, how to tell a browser reading its own profile from something else reading it, and the browser management settings that shrink what can be found. It does not repeat infostealer or session hijacking material; it links to it.
Key takeaways
- The detection is "non-browser process reads browser profile". ATT&CK v20 detection strategy DET0013 looks for PowerShell, cmd.exe, shells, scripting runtimes or unknown tools opening bookmark, history and autofill databases that normally only the browser touches.
- Administrators are the target. CISA advisory AA24-038A describes Volt Typhoon going after a network administrator's Chrome History file, then months later the Local State and Login Data files, over SMB.
- Remote profile access is a strong signal. Reading another user's browser profile through an admin share, as in the Volt Typhoon and Chimera cases, should never happen in normal operations.
- Discovery and credential theft share files. The same profile folder holds history (T1217), saved passwords (T1555.003) and cookies (T1539), so one detection on profile access covers the start of all three.
- Browser management reduces the prize. Blocking personal profiles and sync, turning off the built-in password manager where a corporate one exists, and keeping admin work in a dedicated browser profile or device limit what any discovery returns.
What T1217 is and what browser data reveals
ATT&CK describes Browser Information Discovery as enumerating information about browsers to learn about the compromised environment. Bookmarks, accounts and browsing history can reveal personal information and details about internal resources such as servers, tools and dashboards, and may point to credentials cached by the browser. Data sits in local files and databases in the user profile, for example under %APPDATA% and %LOCALAPPDATA% on Windows for Chromium browsers, ~/.config/google-chrome/ and ~/.mozilla/ on Linux, and ~/Library/Application Support/ and ~/Library/Safari on macOS. The technique has no sub-techniques in v20.
| Browser artefact | What it tells an adversary | Related technique |
|---|---|---|
| Bookmarks | Curated list of the admin consoles, IdP tenant URLs, VPN portals, Citrix and internal wikis the user relies on | T1217 |
| History | Which SaaS tenants, cloud consoles and internal hostnames are actually in use, and when | T1217 |
| Autofill and saved accounts | Usernames and email addresses per site, including personal accounts | T1217, T1555.003 |
| Login Data and Local State (Chromium) | Saved passwords and, in Local State, the key protecting them, as CISA AA24-038A notes | T1555.003 |
| Cookies | Live sessions for SaaS and IdP portals | T1539 |
| Extensions list | Password managers and authenticator extensions worth targeting | T1217 |
For the credential and session side see the T1555 Credentials from Password Stores Defensive Guide and MITRE ATT&CK T1539 Steal Web Session Cookie.
Real cases
| Actor or software | What was recorded | Detection lesson |
|---|---|---|
| Volt Typhoon (G1017), CISA AA24-038A | Strategically targeted network administrator browser data, focusing on history and stored credentials. In one victim the actors tried to fetch an administrator's Chrome History file over C$ during an RDP session, later accessed a History.zip copy in the user's Downloads folder, and about four months later accessed the same user's Local State and Login Data files over SMB. In another, they accessed Chrome and Edge user data directories on multiple systems over the network | Server-side share auditing on workstations and admin hosts catches remote profile reads that endpoint process rules miss |
| Fox Kitten (G0117) | Used Google Chrome bookmarks to identify internal resources and assets (ATT&CK, citing CISA AA20-259A) | Bookmarks are a recon shortcut after initial access |
| Chimera (G0114) | Read a remote user's imported bookmarks over the C$ share, filtering for Citrix entries (ATT&CK, citing NCC Group) | Targeted remote access to Favorites and Bookmarks paths |
| Kimsuky (G0094) | Collected login credentials, bookmarks, cookies and encryption keys with a GetBrowserData() function | Malware reads the profile directly, without spawning tools |
| Scattered Spider (G1015) | Retrieved browser histories through infostealer malware such as Raccoon Stealer (ATT&CK, citing CISA AA23-320A) | Infostealers bundle T1217 with credential and cookie theft |
See the Volt Typhoon Threat Actor Profile, the Pioneer Kitten Threat Actor Profile Guide and the Infostealer Threat Guide.
What to detect and where
DET0013 has one analytic per platform. Each defines the browser data paths and the processes that are not expected to touch them as tunable elements.
| Platform | Behaviour | Log sources named in v20 | Tunable elements |
|---|---|---|---|
| Windows (AN0037) | PowerShell, cmd.exe or unknown tools access Chrome, Edge or Firefox profile paths, then read, decode or export bookmark, autofill or history databases | Sysmon 1 (process creation), Sysmon 11 (file creation), PowerShell 4103 to 4106 | TargetPathRegex, ParentProcess, ScriptBlockPattern |
| Linux (AN0038) | Shell or script open, read or stat of browser config or SQLite history files | auditd SYSCALL (file access), syslog | BrowserProfilePath, ShellRegex |
| macOS (AN0039) | Non-browser processes (curl, bash, python) reading Chrome or Safari databases in the user Library | Unified log, osquery process data | BrowserDBPath, NonBrowserProcessList |
Making it work in practice
- Add file access telemetry: process creation alone will not show a binary reading a SQLite file. Use EDR file read events, Windows object access auditing (SACLs on the profile folders of high-value users), auditd watch rules on Linux, or Endpoint Security file events on macOS.
- Allow-list by signed image: the browsers themselves, their updaters, sanctioned backup and profile roaming tools and the EDR agent. Everything else reading History, Bookmarks, Login Data, Local State, places.sqlite or cookies databases is suspicious.
- Watch for copies and archives: Volt Typhoon's History.zip in a Downloads folder shows that staging a copy of a profile file is part of the pattern. Alert on browser database files written outside the profile path (Sysmon 11).
- Alert on remote profile access: on admin workstations and jump hosts, audit network access to \Users\*\AppData paths through C$ (event 5145 with ShareName C$ and a RelativeTargetName under a browser profile). Normal users never do this.
- Prioritise privileged users: start with domain, cloud, SaaS and network administrators, whose bookmarks and history describe the control plane.
Where identity fits
Browser data is where identity sprawl becomes visible. Saved logins for service accounts, shared admin accounts in a personal browser profile, and bookmarks to every IdP and SaaS admin console turn a single compromised workstation into a list of identity targets. Two incidents on NHI Mgmt Group show the pattern:
- Service account in a personal profile: in the Okta Support System Breach 2023, an employee had saved a support service account's credentials in a personal Google profile in Chrome on a managed laptop. Okta's response included disabling the service account and blocking personal Google profiles in Chrome on managed devices.
- Synced corporate password: in the Cisco Breach 2022, a corporate password saved in the browser and synced to a personal Google account was exposed when the attacker gained control of that account.
Neither incident needed T1217 on a corporate host, but both show that whatever a browser holds can be discovered by whoever reaches it. Keep non-human credentials in a vault, not a browser. See the Browser Saved Credential Check.
Mitigations and browser hardening
ATT&CK v20 maps no mitigation to T1217, because the data is the user's own. The controls below are NHI Mgmt Group recommendations that reduce what discovery returns and make access visible. Policy names are from the Chromium policy definitions; Microsoft Edge documents its own equivalents.
| Control | Example setting | Effect |
|---|---|---|
| Restrict browser sign-in to corporate accounts | Chrome policies BrowserSignin and RestrictSigninToPattern; BrowserAddPersonEnabled set to off | Stops personal profiles, which removes the Okta-style path |
| Control sync | SyncDisabled, or SyncTypesListDisabled listing "passwords" (and "typedUrls" or "bookmarks" if needed) | Corporate credentials do not leave the device |
| Use a corporate password manager | PasswordManagerEnabled set to disabled where a managed vault is deployed, then clear existing saved passwords | No new passwords are saved (the policy leaves existing ones usable), so less is there to find and steal |
| Separate admin browsing | Dedicated admin browser profile, privileged access workstation or isolated session for consoles | Everyday browser history no longer maps the control plane |
| Bind sessions to the device | Device-bound session credentials where supported | Copied cookies are less useful off-device |
| Restrict remote admin share access | Block inbound SMB to workstations; limit C$ access to tiered admin accounts | Prevents the remote profile reads seen with Volt Typhoon and Chimera |
See the Browser Security Hardening Guide and the Device-Bound Session Credentials (DBSC) Guide.
How to test
- Baseline: collect 14 to 30 days of file access to browser profile paths on a pilot group of administrators and list every process that touched them.
- Emulate safely: in an approved test ring, with a test user and a test browser profile, have a script read the bookmarks and history files, copy one to Downloads, and read the profile of another test user over C$. Use an authorised emulation framework mapped to T1217.
- Confirm alerts: non-browser read, copy outside profile and remote profile access should each alert, with user, host and parent process.
- Report-only first: run for two weeks, add sanctioned tools by signer, then promote. If a browser or backup update triggers a flood, return the rule to report-only and allow-list by signature, not by path.
Measures: share of privileged users covered by profile file access telemetry, non-browser profile reads per week after tuning, remote profile access events (target zero), number of managed devices allowing personal browser profiles, and number of saved corporate passwords found in managed browsers.
Common failure patterns
- Process rules without file telemetry: malware that reads the database in process, as Kimsuky's GetBrowserData() did, never shows a suspicious command line.
- No auditing of admin shares on workstations: remote reads of browser profiles over C$ go unseen because workstation SMB access is not logged.
- Personal profiles on managed devices: corporate and service account credentials end up in data the organisation cannot see or wipe, as the Okta case shows.
- Admins browsing the web and consoles in one profile: history becomes a complete list of the organisation's control planes.
- Treating it as an infostealer-only problem: hands-on operators like Volt Typhoon read browser data manually over months, so detections tuned only to known stealer binaries miss them.
Related discovery techniques: T1083 File and Directory Discovery, T1518 Software Discovery and T1082 System Information Discovery.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1217, TA0007, DET0013 | Technique and analytics |
| MITRE ATT&CK v20 | T1555.003, T1539, T1552.001 | Credential and session theft from the same data (each has its own page) |
| NIST SP 800-53 Rev 5 | CM-7 Least Functionality, AC-6 Least Privilege, SI-4 System Monitoring | Browser configuration, admin separation, monitoring |
| NIST CSF 2.0 | PR.DS-01, DE.CM-09, DE.AE-02 | Data at rest, endpoint monitoring, event analysis |
Practitioner checklist
- Collect file access telemetry for browser profile paths on all privileged users' devices.
- Deploy a rule for non-browser processes reading History, Bookmarks, Login Data, Local State, places.sqlite and cookies databases.
- Alert on browser database files copied outside the profile folder.
- Audit and alert on remote access to user profile paths through C$ on workstations and jump hosts.
- Block personal browser profiles and restrict sign-in to corporate accounts on managed devices.
- Disable password sync, or the built-in password manager where a corporate vault exists.
- Give administrators a separate browser profile or device for consoles.
- Search managed browsers for saved service account credentials and move them into a vault.
Standards and references
- MITRE ATT&CK: T1217 Browser Information Discovery
- CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- MITRE ATT&CK: T1555.003 Credentials from Web Browsers
- MITRE ATT&CK: Fox Kitten (G0117)
- Chromium: Enterprise policy definitions
- Microsoft Learn: Event 5145 network share object access check
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Infostealer Threat Guide · Discovery and Reconnaissance Techniques Guide · Browser Forensics Guide · Enterprise Browser and Browser Security Guide · Infostealer Logs and Session Token Abuse Guide