Phoenix Studio
Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a live sigma-cli backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,707
Ready to search
Backends
17
Live from sigconverter.io
CLI Versions
10
Newest: 2.0.2
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
Access to Browser Login Data
Target Profile
Splunk
Splunk SPL & tstats data model queries
Format Mode
Default
Plain SPL queries
Conversion Output
Access to Browser Login Data
Using Splunk · Default · sigma-cli 2.0.2
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
BackendSplunkFormatDefaultVersion2.0.2
title: Access to Browser Login Data
id: fc028194-969d-4122-8abe-0470d5b8f12f
related:
- id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d
type: obsolete
- id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
type: similar
status: test
description: |
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
author: frack113
date: 2022-01-30
tags:
- attack.credential-access
- attack.t1555.003
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection_cmd:
ScriptBlockText|contains|all:
- Copy-Item
- '-Destination'
selection_path:
ScriptBlockText|contains:
- '\Opera Software\Opera Stable\Login Data'
- '\Mozilla\Firefox\Profiles'
- '\Microsoft\Edge\User Data\Default'
- '\Google\Chrome\User Data\Default\Login Data'
- '\Google\Chrome\User Data\Default\Login Data For Account'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
CLI command
Copy the exact command to reproduce this translation locally.
sigma convert --without-pipeline -t splunk -f default rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml