# Firefox Browsing History

## Overview

**Evidence:** Firefox Browsing History\
**Description:** Collect visited URLs from Mozilla Firefox\
**Category:** Applications\
**Platform:** linux\
**Short Name:** fhst\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

Browser history records all websites visited by users, including URLs, page titles, visit timestamps, visit counts, and transition types. This data is essential for reconstructing user activity, identifying malicious websites, and tracking lateral movement or reconnaissance activities.

## Data Collected

This collector gathers structured data about firefox browsing history.

### Firefox Browsing History Data

| Field                  | Description           | Example                   |
| ---------------------- | --------------------- | ------------------------- |
| `AccessTime`           | Access Time           | 2023-10-15 14:30:25+03:00 |
| `AccessCount`          | Access Count          | 123                       |
| `URL`                  | URL                   | Example value             |
| `Browser`              | Browser               | Example value             |
| `Title`                | Title                 | Example value             |
| `VisitDuration`        | Visit Duration        | Example value             |
| `Referrer`             | Referrer              | Example value             |
| `TypedCount`           | Typed Count           | 123                       |
| `IsHidden`             | Is Hidden             | true                      |
| `TransitionType`       | Transition Type       | Example value             |
| `VisitID`              | Visit ID              | 123                       |
| `TransitionQualifiers` | Transition Qualifiers | Example value             |
| `User`                 | User                  | Example value             |
| `Profile`              | Profile               | Example value             |
| `HistoryFilePath`      | History File Path     | Example value             |

## Collection Method

This collector queries the browser's History database to extract visited URLs, timestamps, referrer information, and user interaction patterns.

## Forensic Value

Browsing history reveals phishing sites, malicious domains, command-and-control servers, data exfiltration targets, and reconnaissance activities. Analysts can identify compromised credentials, track attacker infrastructure, and correlate web activity with other security events to establish attack timelines.