Skip to content

Hide Navigation Hide TOC

Automated Collection Bookmarks Using Get-ChildItem PowerShell (e0565f5d-d420-4e02-8a68-ac00d864f9cf)

Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Cluster A Galaxy A Cluster B Galaxy B Level
Automated Collection Bookmarks Using Get-ChildItem PowerShell (e0565f5d-d420-4e02-8a68-ac00d864f9cf) Sigma-Rules Browser Information Discovery - T1217 (5e4a2073-9643-44cb-a0b5-e7f4048446c7) Attack Pattern 1