Web Browser Credential Data Accessed by Unsigned or Untrusted Process

[rule]
description = """
Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "ca46963e-c632-44cb-bb3c-a5f17a2b2c56"
license = "Elastic License v2"
name = "Web Browser Credential Data Accessed by Unsigned or Untrusted Process"
os_list = ["macos"]
reference = ["https://www.elastic.co/security-labs/beyond-the-wail"]
version = "1.0.16"

query = '''
file where event.action == "open" and process.executable != null and 
 file.name like~ ("cookies.sqlite", 
                  "key?.db", 
                  "logins.json", 
                  "Cookies", 
                  "Cookies.binarycookies", 
                  "Login Data") and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 not file.path like~ "/Users/*/Library/Application Support/Slack/Cookies" and
 not process.code_signature.signing_id like "org.mozilla.firefox" and
 not Effective_process.executable like "/Applications/Vorta.app/Contents/MacOS/vorta-darwin" and
 not (process.executable like ("/opt/homebrew/*", "/Users/*/.cursor/extensions/openai.chatgpt-*-universal/bin/macos-aarch64/*", "/Users/*/.nvm/versions/node/v*/lib/node_modules/@anthropic-ai/claude-code/vendor/ripgrep/arm64-darwin/*", "/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-*/vendor/*/rg") and process.name == "rg") and
 not process.executable like ("/opt/homebrew/Cellar/nss/*/bin/*", "/Library/Tanium/TaniumClient/*", "/Users/*/Library/Caches/ms-playwright/*/firefox/*") and
 not process.code_signature.signing_id : ("rg-*", "rg")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"