Microsoft OCS Assessment Tool (Office Communication Server)

DumpBrowserSecrets is a publicly available post‑exploitation tool that harvests credentials and sensitive browser data from Chrome, Edge, Brave, Opera variants, Vivaldi, and Firefox; it implements an App‑Bound Encryption bypass for Chromium browsers by spawning a headless process and injecting a DLL to use the IElevator COM interface, and includes DPAPI and NSS handling, file‑lock bypass, and multiple evasion techniques. The report covers extracted data types, operational usage examples, detection opportunities (process injection, IElevator calls, headless browser instantiation, reads of browser SQLite files), and mitigation advice such as using dedicated credential managers and monitoring for relevant behaviors.