自动化接入 · API / MCP EN

技术说明 · T1217

Browser Information Discovery

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).

ATT&CK T1217 platforms — 状态 有效 版本 20.1

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.1 Browser information may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).2

  1. Kaspersky Autofill
  2. Chrome Roaming Profiles

使用该技术的组织

组织名称国家
grp_g0117Fox Kitten—
grp_g1015Scattered Spider—
grp_g0114ChimeraChina
grp_g1036Moonstone SleetDPRK
grp_g1017Volt Typhoon—
grp_g0082APT38DPRK
grp_g0094KimsukyDPRK

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核;置信度与有效期按引用读取。