Failed Access Attempt to Web Browser Files

Description

Identifies a failed access attempt to web browser's credential store data. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

Query · eql

file where event.type == "access" and event.outcome == "failure" and process.pid != 4 and user.id != "S-1-5-18" and
    process.executable != null and process.thread.Ext.call_stack_summary != null and
    (
     file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or 
     file.path : 
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State", 
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", 
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
     ) and

    not (file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\*" and
         process.executable : "?:\\Windows\\System32\\PrintIsolationHost.exe") and
    not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and user.id : "S-1-5-18") and
    not (process.code_signature.subject_name : 
              ("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "TPZ SOLUCOES DIGITAIS LTDA",
               "Bitdefender SRL", "Ivanti, Inc.", "McAfee, Inc.", "Fortinet Technologies*", "Zscaler, Inc.", "Bromium, Inc.", 
               "Duck Duck Go, Inc.", "Galactic Advisors, Inc.", "Kaspersky Lab JSC", "3Dconnexion SAM", "Opera Norway AS", 
               "Dashlane", "TeamDev Ltd.", "Mobatek", "Shift Technologies Inc.", "Nextron Systems GmbH",
               "Wavesor Software (Eightpoint Technologies Ltd. SEZC)", "Viber Media S.a r.l.", "Eric R. Zimmerman",
               "SAP SE", "Vivaldi Technologies AS", "ONELAUNCH TECHNOLOGIES INC.", "SentinelOne Inc.", "Brave Software, Inc.",
               "Overwolf Ltd", "YANDEX LLC", "Keeper Security Inc.", "Dashlane USA, Inc.", "Spotify AB", "Island Technology Inc.",
               "Zoom Video Communications, Inc.", "Emsisoft Ltd", "REVERSO S.A.S.", "Zoom Video Communications, Inc.",
               "TeamDev Ltd.", "TeamDev Management*", "Fabrice PARISOT", "Beijing Qihu Technology Co., Ltd.", "timeBro GmbH",
               "Lenovo", "7270356 Canada Inc.", "VS REVO GROUP OOD", "Jio Platforms Limited", "Zhuhai Kingsoft Office Software Co., Ltd.",
               "Adaware Software (7270356 CANADA INC.)", "Google Inc", "SweetLabs Inc", "Avast Software s.r.o.", "Athenahealth, Inc.",
               "Tencent Technology (Shenzhen) Company Limited", "AOMEI International Network Limited", "Lavasoft Software Canada Inc.",
               "memtime GmbH", "Grammarly, Inc.", "Sunstream Labs (Capital Intellect Inc.)", "Echo Infini Sdn. Bhd.", "Matrix42 AG",
               "Sunstream Labs (Capital Intellect Inc.)", "OneStart Technologies LLC", "Grammarly, Inc.", "Canva", "PERPLEXITY AI, INC.",
               "salesforce.com, inc.", "Matrix42 AG", "BlazerBrowser.com LLC", "BROWSERWORKS LTD", "Exclaimer Ltd", "BrowseAI LLC") and
         process.code_signature.trusted == true) and
    not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\BingSvc\\BingSvc.exe" and process.code_signature.trusted == true and
         process.code_signature.subject_name == "Microsoft Corporation") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe",
                              "?:\\Program Files\\*.exe",
                              "?:\\Windows\\System32\\cleanmgr.exe",
                              "?:\\Windows\\System32\\cmimageworker.exe",
                              "?:\\Windows\\System32\\igfxext.exe",
                              "?:\\Windows\\SysWOW64\\SearchIndexer.exe",
                              "?:\\Windows\\SysWOW64\\msiexec.exe",
                              "?:\\Windows\\System32\\msiexec.exe",
                              "C:\\Windows\\System32\\RuntimeBroker.exe",
                              "C:\\Windows\\System32\\taskhostw.exe",
                              "C:\\Windows\\System32\\MoUsoCoreWorker.exe",
                              "\\Device\\Mup\\*",
                              "?:\\Windows\\explorer.exe",
                              "?:\\Windows\\CCM\\CcmExec.exe",
                              "?:\\Windows\\System32\\cmd.exe",
                              "?:\\Windows\\System32\\dllhost.exe",
                              "?:\\Windows\\System32\\svchost.exe",
                              "?:\\Windows\\System32\\Robocopy.exe",
                              "?:\\Windows\\System32\\SearchProtocolHost.exe",
                              "?:\\Users\\*e\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
                              "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe",
                              "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
                              "?:\\Users\\*\\AppData\\Local\\Carbonate\\Carbonate\\Application\\Carbonate.exe",
                              "C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe") and
    not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable : "?:\\Windows\\System32\\svchost.exe") and
    not process.executable :
                ("?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
                 "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
                 "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
    not (process.name : "certutil.exe" and file.extension : "db") and 
    not file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\GoogleChromePortable\\profile\\Default\\Login Data" and
    not process.thread.Ext.call_stack_summary :
                 ("ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                  "ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
    not (process.name : "chrome.exe" and 
         file.path : ("?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA", 
                      "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\\DEFAULT\\LOGIN DATA", 
                      "?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\LOGIN DATA")) and
     not file.path : ("?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\UNGOOGLED-CHROMIUM-PORTABLE\\DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
                   "?:\\Users\\*\\chrome-device\\Default\\Login Data",
                   "?:\\Users\\*\\EBWebView\\Default\\Login Data",
                   "?:\\Users\\*\\Favorites\\BOOKMARKS\\Default\\Login Data",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\ELROND\\MAIAR\\USER DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Default BackupDD\\Login Data",
                   "?:\\Users\\*\\Favorites\\bookmarks\\Default\\Login Data",
                   "?:\\users\\*\\mayanks\\JxBrowserData\\Default\\Login Data",
                   "?:\\Users\\*\\AppData\\Local\\pc_app_store\\User Data\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Melvor Idle\\User Data\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Streaming\\User Data\\Default\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\BETAFLIGHT-CONFIGURATOR\\USER DATA\\DEFAULT\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\LEADING\\USER DATA\\DEFAULT\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\*",
                   "?:\\Users\\*\\AppData\\Local\\Uniflash\\User Data\\Default\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\*",
                   "?:\\users\\*\\appdata\\local\\Market Axess\\Data\\*\\mayanks\\JxBrowserData\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Temp\\flutter_tools.*\\flutter_tools_chrome_device.*\\Default\\Login Data",
                   "?:\\Users\\*\\AppData\\Local\\*\\EBWebView\\Snapshots\\*\\Default\\Login Data",
                   "?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\SNAPSHOTS\\*\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\EBWEBVIEW\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\ALS_JXBROWSER_CONTEXT_*\\LOGIN DATA",
                   "?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\BaseLayer\\Files\\Users\\WDAGUtilityAccount\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data") and
     not process.thread.Ext.call_stack_summary like
                             ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|kernelbase.dll|shift.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|kernelbase.dll|msedge.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|defaultpackoffer.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|appvisvsubsystems32.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|qipcap.dll|cmd.exe|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.dll|*",
                              "ntdll.dll|kernelbase.dll|procexp64.exe|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|appvisvsubsystems32.dll|kernelbase.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|filesyncsessions.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|fluencyds.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|dsadmin.dll|dsuiext.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|microsoft.sharepoint.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|spark-windows-desktop-ui.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|*")
Raw source Failed Access Attempt to Web Browser Files · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
Identifies a failed access attempt to web browser's credential store data. Adversaries may steal credentials from web
browsers by reading files specific to the target browser.
"""
id = "ebbb46d3-eb7f-4247-88fe-9bc5525443b3"
license = "Elastic License v2"
name = "Failed Access Attempt to Web Browser Files"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.37"

query = '''
file where event.type == "access" and event.outcome == "failure" and process.pid != 4 and user.id != "S-1-5-18" and
    process.executable != null and process.thread.Ext.call_stack_summary != null and
    (
     file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or 
     file.path : 
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State", 
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", 
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
     ) and

    not (file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\*" and
         process.executable : "?:\\Windows\\System32\\PrintIsolationHost.exe") and
    not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and user.id : "S-1-5-18") and
    not (process.code_signature.subject_name : 
              ("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "TPZ SOLUCOES DIGITAIS LTDA",
               "Bitdefender SRL", "Ivanti, Inc.", "McAfee, Inc.", "Fortinet Technologies*", "Zscaler, Inc.", "Bromium, Inc.", 
               "Duck Duck Go, Inc.", "Galactic Advisors, Inc.", "Kaspersky Lab JSC", "3Dconnexion SAM", "Opera Norway AS", 
               "Dashlane", "TeamDev Ltd.", "Mobatek", "Shift Technologies Inc.", "Nextron Systems GmbH",
               "Wavesor Software (Eightpoint Technologies Ltd. SEZC)", "Viber Media S.a r.l.", "Eric R. Zimmerman",
               "SAP SE", "Vivaldi Technologies AS", "ONELAUNCH TECHNOLOGIES INC.", "SentinelOne Inc.", "Brave Software, Inc.",
               "Overwolf Ltd", "YANDEX LLC", "Keeper Security Inc.", "Dashlane USA, Inc.", "Spotify AB", "Island Technology Inc.",
               "Zoom Video Communications, Inc.", "Emsisoft Ltd", "REVERSO S.A.S.", "Zoom Video Communications, Inc.",
               "TeamDev Ltd.", "TeamDev Management*", "Fabrice PARISOT", "Beijing Qihu Technology Co., Ltd.", "timeBro GmbH",
               "Lenovo", "7270356 Canada Inc.", "VS REVO GROUP OOD", "Jio Platforms Limited", "Zhuhai Kingsoft Office Software Co., Ltd.",
               "Adaware Software (7270356 CANADA INC.)", "Google Inc", "SweetLabs Inc", "Avast Software s.r.o.", "Athenahealth, Inc.",
               "Tencent Technology (Shenzhen) Company Limited", "AOMEI International Network Limited", "Lavasoft Software Canada Inc.",
               "memtime GmbH", "Grammarly, Inc.", "Sunstream Labs (Capital Intellect Inc.)", "Echo Infini Sdn. Bhd.", "Matrix42 AG",
               "Sunstream Labs (Capital Intellect Inc.)", "OneStart Technologies LLC", "Grammarly, Inc.", "Canva", "PERPLEXITY AI, INC.",
               "salesforce.com, inc.", "Matrix42 AG", "BlazerBrowser.com LLC", "BROWSERWORKS LTD", "Exclaimer Ltd", "BrowseAI LLC") and
         process.code_signature.trusted == true) and
    not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\BingSvc\\BingSvc.exe" and process.code_signature.trusted == true and
         process.code_signature.subject_name == "Microsoft Corporation") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe",
                              "?:\\Program Files\\*.exe",
                              "?:\\Windows\\System32\\cleanmgr.exe",
                              "?:\\Windows\\System32\\cmimageworker.exe",
                              "?:\\Windows\\System32\\igfxext.exe",
                              "?:\\Windows\\SysWOW64\\SearchIndexer.exe",
                              "?:\\Windows\\SysWOW64\\msiexec.exe",
                              "?:\\Windows\\System32\\msiexec.exe",
                              "C:\\Windows\\System32\\RuntimeBroker.exe",
                              "C:\\Windows\\System32\\taskhostw.exe",
                              "C:\\Windows\\System32\\MoUsoCoreWorker.exe",
                              "\\Device\\Mup\\*",
                              "?:\\Windows\\explorer.exe",
                              "?:\\Windows\\CCM\\CcmExec.exe",
                              "?:\\Windows\\System32\\cmd.exe",
                              "?:\\Windows\\System32\\dllhost.exe",
                              "?:\\Windows\\System32\\svchost.exe",
                              "?:\\Windows\\System32\\Robocopy.exe",
                              "?:\\Windows\\System32\\SearchProtocolHost.exe",
                              "?:\\Users\\*e\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
                              "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe",
                              "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
                              "?:\\Users\\*\\AppData\\Local\\Carbonate\\Carbonate\\Application\\Carbonate.exe",
                              "C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe") and
    not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable : "?:\\Windows\\System32\\svchost.exe") and
    not process.executable :
                ("?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
                 "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
                 "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
    not (process.name : "certutil.exe" and file.extension : "db") and 
    not file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\GoogleChromePortable\\profile\\Default\\Login Data" and
    not process.thread.Ext.call_stack_summary :
                 ("ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll",
                  "ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
    not (process.name : "chrome.exe" and 
         file.path : ("?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA", 
                      "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\\DEFAULT\\LOGIN DATA", 
                      "?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\LOGIN DATA")) and
     not file.path : ("?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\UNGOOGLED-CHROMIUM-PORTABLE\\DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
                   "?:\\Users\\*\\chrome-device\\Default\\Login Data",
                   "?:\\Users\\*\\EBWebView\\Default\\Login Data",
                   "?:\\Users\\*\\Favorites\\BOOKMARKS\\Default\\Login Data",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\ELROND\\MAIAR\\USER DATA\\DEFAULT\\LOGIN DATA",
                   "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Default BackupDD\\Login Data",
                   "?:\\Users\\*\\Favorites\\bookmarks\\Default\\Login Data",
                   "?:\\users\\*\\mayanks\\JxBrowserData\\Default\\Login Data",
                   "?:\\Users\\*\\AppData\\Local\\pc_app_store\\User Data\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Melvor Idle\\User Data\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Streaming\\User Data\\Default\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\BETAFLIGHT-CONFIGURATOR\\USER DATA\\DEFAULT\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\LEADING\\USER DATA\\DEFAULT\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\*",
                   "?:\\Users\\*\\AppData\\Local\\Uniflash\\User Data\\Default\\*",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\*",
                   "?:\\users\\*\\appdata\\local\\Market Axess\\Data\\*\\mayanks\\JxBrowserData\\Default\\*",
                   "?:\\Users\\*\\AppData\\Local\\Temp\\flutter_tools.*\\flutter_tools_chrome_device.*\\Default\\Login Data",
                   "?:\\Users\\*\\AppData\\Local\\*\\EBWebView\\Snapshots\\*\\Default\\Login Data",
                   "?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\SNAPSHOTS\\*\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\EBWEBVIEW\\DEFAULT\\LOGIN DATA",
                   "?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\ALS_JXBROWSER_CONTEXT_*\\LOGIN DATA",
                   "?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\BaseLayer\\Files\\Users\\WDAGUtilityAccount\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data") and
     not process.thread.Ext.call_stack_summary like
                             ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|kernelbase.dll|shift.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|kernelbase.dll|msedge.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|defaultpackoffer.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|appvisvsubsystems32.dll|kernelbase.dll|hmpalert.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|qipcap.dll|cmd.exe|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.dll|*",
                              "ntdll.dll|kernelbase.dll|procexp64.exe|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|kernel32.dll|ntdll.dll",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|appvisvsubsystems32.dll|kernelbase.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|filesyncsessions.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|fluencyds.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|dsadmin.dll|dsuiext.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|microsoft.sharepoint.dll|*",
                              "ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|spark-windows-desktop-ui.dll|*",
                              "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|*")
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.7.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.