Title:PUA - WebBrowserPassView Execution Status:test Description:Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera References: -https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1555.003/T1555.003.md Author: frack113 Date: 2022-08-20 modified:2023-02-14 Tags:
-'attack.credential-access'
-'attack.t1555.003'
Logsource:
category: process_creation
product: windows
Detection: selection: Description:'Web Browser Password Viewer'Image|endswith:'\WebBrowserPassView.exe'condition:selection Falsepositives:
-Legitimate use Level:medium
