Firefox Encrypted Login Entry
Detects Firefox logins.json encrypted password entries in the JSON format used by Firefox's NSS (Network Security Services) credential store. Mirrors Snaffler rule KeepFFRegexRed.
- Type
- regex
- Engine
- boost_regex
- Confidence
- high
- Confidence justification
- High confidence: the encryptedPassword JSON key combined with the base64 value constraint is highly specific to Firefox logins.json. The field name is not used in other common credential formats.
- Jurisdictions
- global
- Regulations
- Criminal Code Act 1995 (Cth)
- Frameworks
- CIS Controls, ISO 27001, NIST CSF
- Data categories
- credentials
- Scope
- specific
- Risk rating
- 8
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible
Pattern
"encryptedPassword"\s*:\s*"[A-Za-z0-9+/=]{16,}"Corroborative evidence keywords
encryptedUsername, formSubmitURL, guid, timeCreated
Proximity: 300 characters
Should match
"encryptedPassword":"AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="— Low-tier probe - encrypted password field without paired login data{"encryptedUsername":"MDIEEPgAAA==","encryptedPassword":"MFoECNQ3Mk7Yo7yEECabcdefghijklmnop"}— Medium-tier probe - paired NSS-encrypted username and password{"hostname":"https://portal.example.org","formSubmitURL":"https://portal.example.org/login","encryptedUsername":"MDIEEPgAAA==","encryptedPassword":"MFoECNQ3Mk7Yo7yEECabcdefghijklmnop","guid":"{7b2e}","timeCreated":1710000000000}— High-tier probe - complete Firefox login entry with origin and metadata{"encryptedUsername":"MDoEEPgAAAAAAAAAAAA=","encryptedPassword":"MDoEEPgAAAAAAAAAAAAAAAAAAAEwFDAN"}— Medium-tier probe - paired NSS ciphertext fields
Should not match
"encryptedPassword":""— Empty value, under 16 chars"password":"hunter2"— Plaintext field name, not encryptedPassword"encryptedPassword":"not base64 ciphertext!"— Malformed ciphertext contains non-Base64 characters{"hostname":"https://portal.example.org","encryptedUsername":"PLACEHOLDER","encryptedPassword":"REDACTED_REDACTED","guid":"{abc}","timeCreated":1}— Placeholder Firefox entry must not enforceDocumentation example: {"hostname":"https://portal.example.org","encryptedUsername":"MDIEEPgAAA==","encryptedPassword":"MFoECNQ3Mk7Yo7yEECabcdefghijklmnop","guid":"{abc}","timeCreated":1}— Documentation quoting a complete login entry must not enforce{"origin_url":"https://portal.example.org","username_value":"admin","password_value":"encrypted"}— Sibling Chromium login-data field names are not Firefox logins.json
Known false positives
- Security research or malware analysis reports that quote Firefox logins.json content as examples without actual stolen credentials. Mitigation: Require proximity to additional logins.json fields (encryptedUsername, formSubmitURL, guid) to confirm file context.
- Backup or archive files containing encrypted Firefox profiles that are legitimately owned by the user. Mitigation: Scope detection to unexpected locations such as email attachments, cloud storage, or code repositories rather than standard browser profile paths.