Full Report
Explore the forensic perspective of the Microsoft Edge Chromium-based version and its features, such as msedge_proxy, edge cache location, and more.
Analysis Summary
# Tool/Technique: Microsoft Edge (Chromium) Forensic Artifacts
## Overview
This technique involves the forensic analysis of the Chromium-based Microsoft Edge browser to reconstruct user activity, recover deleted data, and identify potential signs of compromise. As modern browsers act as the primary interface for users, they serve as a critical repository for evidence of malware delivery, credential theft, and unauthorized data exfiltration.
## Technical Details
- **Type**: Forensic Analysis Technique
- **Platform**: Windows, macOS, Android
- **Capabilities**: Extraction of browsing history, bookmarks, cookies, network cache, and session data.
- **First Seen**: Edge Chromium released January 2020.
## MITRE ATT&CK Mapping
- **[TA0009 - Collection]**
- **[T1213 - Data from Information Repositories]**
- **[T1539 - Steal Web Session Cookie]**
- **[TA0006 - Credential Access]**
- **[T1555.003 - Credentials from Web Browsers]**
- **[TA0007 - Discovery]**
- **[T1217 - Browser Information Discovery]**
## Functionality
### Core Capabilities
- **History Recovery**: Accessing the `History` (Windows/Android) or `OfflineCache` (macOS) SQLite databases to retrieve visited URLs, page titles, and visit counts.
- **Cookie Analysis**: Extraction of session tokens and tracking identifiers from `Cookies.binarycookies` or SQLite cookie files.
- **Cache Reconstruction**: Identifying files, scripts, and images downloaded during browsing sessions through the `NetworkCache` records.
### Advanced Features
- **msedge_proxy Identification**: Analyzing proxy configurations and the `msedge_proxy.exe` process which handles network requests, potentially revealing unauthorized proxy redirection.
- **SQLite Freelist Analysis**: Investigating unallocated space within the database files to recover deleted history entries or cleared browser data.
- **Cross-Platform Correlation**: Mapping Edge’s UUID (`565EC255-F158-48E1-83C5-D426BC60D22D` on macOS) to specific application data containers.
## Indicators of Compromise
- **File Names**:
- `History` (Main history database)
- `Cookies` / `Cookies.binarycookies`
- `Login Data` (Stored credentials)
- `Web Data` (Autofill information)
- **Behavioral Indicators**:
- Execution of `msedge.exe` with suspicious command-line flags (e.g., `--remote-debugging-port`).
- Unexpected modifications to the `Secure Preferences` file.
- Large-scale data reads of the `Default\Network` directory by non-browser processes (potential Infostealer activity).
## Associated Threat Actors
- **Infostealer Operators**: Groups utilizing Lumma, RedLine, or Racoon Stealer to target browser data.
- **APT Groups**: Various actors who perform browser-based session hijacking or use browser history for reconnaissance.
## Detection Methods
- **Behavioral Detection**: Monitoring for unauthorized processes attempting to access the `%LocalAppData%\Microsoft\Edge\User Data\` directory.
- **File System Monitoring**: Auditing changes to the `Preferences` and `Extension` folders to detect malicious browser extensions.
- **SQL Analysis**: Using tools like **DB Browser for SQLite** to run queries against `ZONLINESEARCHHISTORY` (macOS) or `urls` (Windows) tables.
## Mitigation Strategies
- **Hardening**: Enable "Application Guard" for Microsoft Edge to isolate browsing sessions in a container.
- **Policy Management**: Use Group Policy (GPO) to disable the saving of passwords and to enforce encrypted sync.
- **Data Protection**: Implement full-disk encryption and restrict access to user profile folders to prevent offline extraction of browser databases.
## Related Tools/Techniques
- **ChromeCacheView**: Used for parsing Edge cache on Windows/Android.
- **EdgeCookiesParser**: Specialized tool for parsing macOS `.binarycookies` files.
- **Chromium Forensics**: The foundational techniques used for Google Chrome and Brave, which share the same underlying architecture as Edge.