Windows Credentials from Web Browsers Saved in TEMP Folder

The following analytic detects the creation of files containing passwords, cookies, and saved login account information by the Braodo stealer malware in temporary folders. Braodo often collects these credentials from browsers and applications, storing them in temp directories before exfiltration. This detection focuses on monitoring for the creation of files with patterns or formats commonly associated with stolen credentials. By identifying these activities, security teams can take needed action to prevent sensitive login data from being leaked, reducing the risk of unauthorized access to user accounts and systems.

ATT&CK coverage

Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers 15 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_11

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Sign in to read it Create an account

Detection catalogue

ATT&CK coverage

Detection requirements

Detection logic