Skip to content

Browser Information Discovery

Technique · ATTACK:enterprise:T1217

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1217",
  "title": "Browser Information Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1217",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--5e4a2073-9643-44cb-a0b5-e7f4048446c7",
  "external_id": "T1217",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2026-09-11T19:56:45.908Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Chrome Roaming Profiles",
      "url": "https://support.google.com/chrome/a/answer/7349337"
    },
    {
      "source_name": "Kaspersky Autofill",
      "url": "https://www.kaspersky.com/blog/browser-data-theft/27871/"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fd71bed-d22f-44f8-aef2-4c5e55aca422

Securelist Calisto July 2018

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1be14720-a61a-4ac6-a6f6-f84c74c60d43

BiZone Lizar May 2021 · Threatpost Lizar May 2021

ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--234ff2d3-48e2-464c-b8a2-4d963c2f2e31

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b569111-149c-47dc-89ff-ef8a24884523

Aryaka Kimsuky July 2025

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--334ae43c-2c0b-4a7a-aab5-6ff59005dbf5

ESET Machete July 2019

ATTACK:enterprise:C0042 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c770dba-9357-4a2b-9431-37bf95c080c5

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42781435-078d-4aad-add9-d70fb5f13bfe

Segurança Informática URSA Sophisticated Loader 2020 · SCILabs Malteiro 2021

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a37d414-b97a-4216-bab7-dfd8417a3508

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · Socket BeaverTail XORIndex HexEval Contagious Interview July 2025 · Socket HexEval BeaverTail Contagious Interview June 2025 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:S1012 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a4ff6a4-c6b1-4bb4-87f4-c28059c7dd39

Cybereason PowerLess February 2022

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b83387a-bba5-44a9-9dc4-3aae9a916d24

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ecf0cd-4e5f-4331-b4d8-42618f155c5c

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64e03a61-21a6-40d6-9c87-30c1f21ba899

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--658f822e-f11c-4c36-8097-8dd21f45b42e

CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e160715-2735-4d96-8918-14036c2804a7

Prevailion DarkWatchman 2021

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87590696-bf1c-4d42-8ef7-851fb10d8053

SentinelLabs Metador Sept 2022

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88427fdf-9d70-49d2-a7ca-4c79ee387d3d

Github PowerShell Empire

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d7094e1-4617-457a-8ecb-e60c2d581f7a

Huntress LightSpy macOS 2024

ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--953d92ff-9f7a-4f50-bfe6-848ea4791dfc

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cf53303-770b-4de2-bbf2-3d79d5432f93

Splunk RedLine Stealer June 2023

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0020049-7688-4c0a-8844-dece3bed614c

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a44fb8bd-e57d-4a75-8d4d-1b77f77d8b5f

ESET MirrorFace 2025

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae256211-86ed-4587-adcf-3311aa8505be

Socket GlassWorm January 2026

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b41527a6-941d-47a7-b2cf-9479f4cd243f

Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023 · Mandiant 3cx UNC4736 2023 · Trend Micro 3CX AppleJeus ICONICSTEALER March 2023

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba8ceccd-5406-418b-9f10-ed333e5f1e9c

S2W Troll Stealer 2024 · Symantec Troll Stealer 2024

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0f7db5b-a4cf-40b1-b581-2ae548ca6303

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:S0079 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8786a8c-9c40-4df3-874f-952b814baec9

Scarlet Mimic Jan 2016

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d86d22e4-87ca-4039-8a36-2708f68704e6

Cybereason LumaStealer Undated

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de740ec2-5915-42c6-81de-9b308ccdab84

Logpoint_StealerMalwareFamilies_2024 · QuorumCyber_Vidar_March2023

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eeea996c-6eaf-4244-b5a8-294df9c008c3

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f01bad7e-e96c-43fe-8ac9-63c4863e8c76

NCC Group Chimera January 2021

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcb54b68-a92c-49c8-a021-c9e0ef1a402c

Kandji Cuckoo April 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.