Automated Collection of Browser Bookmarks Using PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of a PowerShell command that specifically enumerates browser bookmarks. It looks for the use of 'Get-ChildItem' with parameters '-Recurse', '-Path', '-Filter Bookmarks', '-ErrorAction SilentlyContinue', and '-Force'. This activity is indicative of an adversary attempting to discover information about the compromised host by collecting browser bookmark data, which can reveal personal information or details about internal network resources.