T1555.003 – Credentials from Password Stores: Credentials from Web Browsers - Browser Credentials Access by Injected Process
This is a two-part detection, with the first portion identifying injected-into processes by suspected malware, and the second portion identifying the previously identified injected process leveraging the DPAPI to decrypt stored secrets within a browser session. Results from this query will identify browser processes who had their encrypted credentials decrypted via DPAPI and read by the malicious process, highly indicative of stealer activity. Users should treat devices returned by this query as having their stored browser credentials compromised and rotate all saved passwords immediately.
Microsoft Sentinel (KQL)
