Academy
TermData

ULP format

URL:Login:Password

The format in which credentials extracted from logs are listed as “address:username:password” lines.

Flow

  1. 1Extracted from logs
  2. 2Combined
  3. 3Filtered by domain
Related families
—
MITRE ATT&CK
T1555.003 · Credentials from Web Browsers
Sources
5 sources
01

Overview

Browsers store a saved password together with the login page it was saved for. The infostealer reads this triple; logs are combined and turned into ULP lines. MITRE ATT&CK

Because ULP lists are much smaller and more searchable than log archives, they circulate quickly; the same line reappears in different lists for years. Google Cloud (Mandiant)

02

How it works

  1. 1

    Extracted from logs

    The password file in each log is read, and the address, username and password fields are separated. MITRE ATT&CK

  2. 2

    Combined

    Lines from thousands of logs are gathered into a single list and duplicates are removed.

  3. 3

    Filtered by domain

    The buyer searches only for the lines of a specific organization or service; this filtered list is given to the checker.

03

How to detect it

  • The organization’s login addresses (SSO, VPN, webmail) appearing in ULP lists shows that a device that signed in to that address was infected. Google Cloud (Mandiant)
04

What to do

  • Change the password of an account seen in a list and close all its sessions. MITRE ATT&CK
  • Enforce multi-factor authentication. MITRE ATT&CK
05

MITRE ATT&CK

T1555.003Credentials from Web BrowsersT1078Valid AccountsT1539Steal Web Session Cookie
06

Related terms

Terms

Stealer logsCredential leakChecker
07

Sources

  1. 1Credentials from Web Browsers (T1555.003) · MITRE ATT&CK
  2. 2Valid Accounts (T1078) · MITRE ATT&CK
  3. 3Steal Web Session Cookie (T1539) · MITRE ATT&CK
  4. 4UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  5. 5Multi-factor Authentication (M1032) · MITRE ATT&CK