Web Credential Access via Injected Browser

[rule]
description = """
Identifies a potentially injected browser process accessing the password store of commonly used web browsers.
Adversaries may steal credentials from web browsers by reading files specific to the target browser.
"""
id = "8d9b900c-b79e-43cb-83ad-7b2ec3325f13"
license = "Elastic License v2"
name = "Web Credential Access via Injected Browser"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.1"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and process.name : ("msedge.exe", "chrome.exe") and process.args_count == 1]
[file where event.type == "access" and file.name : ("Local State", "Login Data", "Cookies") and 
  process.name : ("msedge.exe", "chrome.exe") and 
  process.thread.Ext.call_stack_summary : "ntdll.dll|kernelbase.dll|Unbacked" and 
  file.path :
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\*\\Login Data",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\*\\Login Data",
            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\*\\Network\\Cookies",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\*\\Network\\Cookies") and 
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.callsite_trailing_bytes :
                         ("488906488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e5bc300000000000000000000",
                          "4c8be8b9000000c04883f8ff0f85880000000f1045df660f73d804660f7ec38bc323c13bc1754041f6c401743a8b45834c8d4da7488b4d5f0fbaf31f48897424"))
]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"