---
{
  "title": "Browser Information Discovery",
  "summary": "Browser information discovery reads browser-related data to learn about a user or environment.",
  "topic": "forensics",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1217"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1217: Browser Information Discovery",
      "url": "https://attack.mitre.org/techniques/T1217"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Browser information discovery reads browser-related data to learn about a user or environment. History, bookmarks, and account context can reveal targets for later activity.


## An investigation example

An unknown process accesses browser profile metadata shortly before contacting services found in the user's recent activity.

## Evidence to examine

Review accessed profile paths, process identity, permissions, output artifacts, and subsequent use of the information.

## A common analytical pitfall

Browser profile access does not automatically establish password or session theft; identify the actual data reached.

## Response considerations

Preserve relevant evidence with appropriate privacy protection and investigate whether discovered information enabled further unauthorized access.


## Browser records can reveal useful context

Browser-related information may expose visited services, profiles, bookmarks, or other clues about a user and environment. An intruder can use those clues to select later targets. Discovery of browser information is distinct from proving that a password, session token, or complete browsing history was stolen. The exact files and operations observed determine the claim.

Browser storage differs across products, versions, and profile settings. Synchronization and multiple profiles can complicate attribution. A record may reflect activity from another device or an automatically loaded resource. Analysts should understand the artifact's meaning rather than treat every URL as deliberate navigation by the current user.

## A fictional service-targeting sequence

An academy's endpoint events show an unfamiliar process reading browser-profile material, followed by attempts to access a service used by staff. Investigators examine the particular files, process ancestry, account context, and subsequent identity activity. They compare the behavior with approved migration or backup software that may legitimately read profile data.

Protect the collected material because it can include private information unrelated to the case. Reports should summarize relevant findings without publishing raw cookies, tokens, or personal browsing details. If telemetry records only a directory read, avoid claiming that every file in the directory was successfully parsed or exported.

## Bound the finding

Create fictional file-access events involving a browser profile and one later service login attempt. State what the events show and list the additional evidence needed to claim credential use or data transfer. Compare a legitimate profile-migration utility with an unknown process performing similar reads. The exercise teaches context and privacy-conscious reporting without accessing another person's actual browser data.

Artifact presence can outlast its original context. A bookmark or saved service address may remain after an employee stops using the service. When interpreting a later attempt, distinguish a plausible targeting clue from proof that the account is active, authenticated, or currently authorized to access the destination.

## Related concepts

- [[digital-forensics]]
- [[incident-timeline]]
- [[logs-and-telemetry]]
- [[unsecured-credentials]]