Query: detect Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing. in logs
Matching passage: Sigma rule: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.. Logsource: windows / process_creation. Rule: title: SQLite Chromium Profile Data DB Access id: 24c77512-782b-448a-8950-eddb0785fc71 status: test description: Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing. references: - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ author: TropChaud date: 2022-12-19 modified: 2023-01-19 tags: - attack.credential-access - attack.t1539 - attack.t1555.003 - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_sql: - Product: SQLite - Image|endswith: - \sqlite.exe - \sqlite3.exe selection_chromium: CommandLine|contains: - \User Data\ - \Opera Software\ - \ChromiumViewer\ selection_data: CommandLine|contains: - Login Data - Cookies - Web Data - History - Bookmarks condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware. Logsource: windows / image_load. Rule: title: Load Of RstrtMgr.DLL By A Suspicious Process id: b48492dc-c5ef-4572-8dff-32bc241c15c8 related: - id: 3669afd2-9891-4534-a626-e5cf03810a61 type: derived status: test description: 'Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes. ' references: - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/ - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/ - https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/ - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html author: Luc Génaux date: 2023-11-28 tags: - attack.impact - attack.defense-impairment - attack.t1486 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: - ImageLoaded|endswith: \RstrtMgr.dll - OriginalFileName: RstrtMgr.dll selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ condition: selection_img and 1 of selection_folders_* falsepositives: - Processes related to software installation level: high