THREAT HUNTING: DETECTING BROWSER CREDENTIAL STEALING

Summary from the TLDR InfoSec newsletter

This post showcases how to detect browser credential extraction, weed out false positives, and improve resilience against this threat by enabling process creation and file access auditing. Tools such as Lazagne and HackerBrowserData are open source and provide customizability to advanced attackers, whereas tools such as Nirsoft’s WebBrowserPassView are closed source and cannot be modified easily.