TA0007 · DISCOVERY
Browser Information Discovery
Adversaries may enumerate information about browsers to learn more about compromised environments.
Detect it with
Monitor processes and command-line arguments for actions that could be taken to gather browser bookmark information. Remote access tools with built-in features may interact directly using APIs to gather information.
Why it matters on shift
Browser Information Discovery is one of the concrete ways adversaries achieve discovery. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After discovery, the next tactic is usually Lateral Movement. Search your telemetry for the transition before closing the ticket.
Kill-chain context