Copying browser credential stores

cred_browser_store_copy

Locates the browser password and cookie databases for Chrome, Edge, Brave and Firefox and copies them into the sandbox, which is exactly what an infostealer does first. Copies are deleted immediately; no database is ever parsed or decrypted.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

--i-understand
Needs explicit consent: this test changes machine state or fetches real offensive tooling.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1539	Steal Web Session Cookie	Credential Access	coverage statistics
T1555.003	Credentials from Web Browsers	Credential Access	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other credential access tests

Other tests in the Credential access category.
Test	What it does	Severity
LSASS minidump via a signed binary cred_lsass_minidump	Attempts the comsvcs.dll MiniDump technique through rundll32 — the most-alerted-on credential-dumping method there is — writing to the sandbox. Any du…	critical
Reading DPAPI master keys cred_dpapi_masterkeys	Enumerates and copies the current user's DPAPI master key blobs, which are what an attacker needs to decrypt saved browser and Credential Manager secr…	high
Enumerating the macOS keychain cred_keychain_dump	Runs security(1) to list the login keychain's item metadata and to dump the keychain without the -d flag, so no secret is ever requested or printed. K…	high
Opening a handle to LSASS cred_lsass_handle	Opens a read handle to the LSASS process with PROCESS_VM_READ and closes it immediately without reading a single byte. Handle acquisition is the step …	high
Harvesting developer and cloud secrets cred_secret_file_harvest	Looks for SSH private keys, cloud CLI credentials, Kubernetes and Docker configuration, .netrc and package-manager tokens, and for credential-shaped e…	high
Credential store access attempt credential_store_access	Attempts to copy the operating system's credential stores into the sandbox — the SAM, SYSTEM and SECURITY registry hives on Windows, /etc/shadow on Li…	high

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.