Credential Gathering Protection module

Guy_Ashkenazi — Tue, 04 Oct 2022 16:18:05 GMT

Hi,

i have a question that i can not fine answer on the documentation on the Credential Gathering Protection module in the malware profile,

is this apply on web browser cache too or just system credential?

thanks for any helps.

Re: Credential Gathering Protection module

mfakhouri — Wed, 05 Oct 2022 14:25:55 GMT

Hi @Guy_Ashkenazi,

This module is applicable for passwords cached when you choose to save your password in web browsers, not just system credentials. For web browsers, this is relevant when attempts to access cached credential files are made in their respective file paths.

The following Unit 42 article is incredibly insightful in highlighting the many ways third-party software stores credentials and how Cortex XDR can provide detection/prevention utilizing the Credential Gathering Protection Module. This write-up also discusses Chromium and Firefox examples, which gives additional information on this module's applicability to web browsers.

https://unit42.paloaltonetworks.com/credential-gathering-third-party-software/

topic Credential Gathering Protection module in Cortex XDR Discussions

Credential Gathering Protection module

Re: Credential Gathering Protection module