Firefox Profile Data Copied for Browser Recon

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to copy Firefox profile data, specifically the 'places.sqlite' file, over SMB (Server Message Block) to a server. This activity is indicative of browser reconnaissance, where an attacker might be exfiltrating browsing history and bookmarks stored in the Firefox profile for further analysis or to gain intelligence about the victim.