Firefox Browsing History
Overview
Evidence: Firefox Browsing History
Description: Collect visited URLs from Mozilla Firefox
Category: Applications
Platform: macos
Short Name: fhst
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Browser history records all websites visited by users, including URLs, page titles, visit timestamps, visit counts, and transition types. This data is essential for reconstructing user activity, identifying malicious websites, and tracking lateral movement or reconnaissance activities.
Data Collected
This collector gathers structured data about firefox browsing history.
Firefox Browsing History Data
| Field | Description | Example |
|---|---|---|
AccessTime | Access Time | 2023-10-15 14:30:25+03:00 |
AccessCount | Access Count | 123 |
URL | URL | Example value |
Browser | Browser | Example value |
Title | Title | Example value |
VisitDuration | Visit Duration | Example value |
Referrer | Referrer | Example value |
TypedCount | Typed Count | 123 |
IsHidden | Is Hidden | true |
TransitionType | Transition Type | Example value |
VisitID | Visit ID | 123 |
TransitionQualifiers | Transition Qualifiers | Example value |
User | User | Example value |
Profile | Profile | Example value |
HistoryFilePath | History File Path | Example value |
Collection Method
This collector queries the browser’s History database to extract visited URLs, timestamps, referrer information, and user interaction patterns.
Forensic Value
Browsing history reveals phishing sites, malicious domains, command-and-control servers, data exfiltration targets, and reconnaissance activities. Analysts can identify compromised credentials, track attacker infrastructure, and correlate web activity with other security events to establish attack timelines.