Last reviewed:
T1555.003 covers credentials obtained from web-browser storage, including browser files and process memory. Synced passkeys add a useful distinction: one private key remains scoped to its relying party, while compromise of a provider security-domain secret can expose separate keys for several relying parties. DCV cannot infer that theft from a later valid cloud session. Detection must retain endpoint file, process-access and memory evidence, then link it to the relevant WebAuthn ceremony and downstream identity activity through explicit account, device and transaction identifiers.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, <code>AppData\Local\Google\Chrome\User Data\Default\Login Data</code> and executing a SQL query: <code>SELECT action_url, username_value, password_value FROM logins;</code>. The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function <code>CryptUnprotectData</code>, which uses the victim’s cached logon credentials as the decryption key.
Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge, etc. Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.
Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.
After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access. This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts (e.g. domain administrator).
Platforms: Linux, macOS, Windows.
DCV does not currently ship a cloud-audit-log finding mapped directly to T1555.003. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables.
CloudSigma does not currently ship a stand-alone rule that fires on T1555.003 in isolation. Generate a starting-point rule from the CVE, vulnerability disclosure, or threat-research blog post that exercises this technique, then pair it with SIEM-side correlation before enabling in production.
High-fidelity detection of T1555.003 requires correlation
across multiple events. For example, a credential-validation call
followed by a reconnaissance chain (List* /
Describe*) within a short window from an unfamiliar
source. A single-event Sigma rule on
GetCallerIdentity alone fires constantly on
legitimate CLI, SDK and CI/CD activity.
Where you have a specific advisory, vulnerability disclosure or blog post that exercises T1555.003-style abuse, CloudSigma can generate a starting-point rule from that input. You then deploy it in your SIEM and combine it with the SIEM's native correlation features (timeframe joins across users, source-IP anomalies, impossible-travel checks). For T1555.003 specifically the generated rule is rarely sufficient on its own; pair it with the SIEM-side correlation logic before enabling in production.
T1555.003 covers credentials obtained from web-browser storage, including browser files and process memory. Synced passkeys add a useful distinction: one private key remains scoped to its relying party, while compromise of a provider security-domain secret can expose separate keys for several relying parties. DCV cannot infer that theft from a later valid cloud session. Detection must retain endpoint file, process-access and memory evidence, then link it to the relevant WebAuthn ceremony and downstream identity activity through explicit account, device and transaction identifiers.
T1555.003 has no cloud-audit-log signal of its own; DCV does not currently ship a finding mapped directly to it. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables (see Related techniques).
T1555.003 is part of MITRE ATT&CK TA0006 Credential Access: How adversaries steal credentials, account names and passwords.
T1555.003 requires multi-event correlation that exceeds a single Sigma rule's structure. CloudSigma can generate a starting-point rule from a CVE, vulnerability disclosure, or threat-research blog post that exercises T1555.003-style abuse; pair it with SIEM-side correlation logic before enabling in production.