Query: write Sigma for Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a
Matching passage: Sigma rule: Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a. Logsource: windows / file_access. Rule: title: Suspicious File Access to Browser Credential Storage id: a1dfd976-4852-41d4-9507-dc6590a3ccd0 status: experimental description: 'Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware. ' references: - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore date: 2025-05-22 tags: - attack.credential-access - attack.t1555.003 - attack.discovery - attack.t1217 logsource: category: file_access product: windows detection: selection_browser_paths: FileName|contains: - \Sputnik\Sputnik - \MapleStudio\ChromePlus - \QIP Surf - \BlackHawk - \7Star\7Star - \CatalinaGroup\Citrio - \Google\Chrome - \Coowon\Coowon - \CocCoc\Browser - \uCozMedia\Uran - \Tencent\QQBrowser - \Orbitum - \Slimjet - \Iridium - \Vivaldi - \Chromium - \GhostBrowser - \CentBrowser - \Xvast - \Chedot - \SuperBird - \360Browser\Browser - \360Chrome\Chrome - \Comodo\Dragon - \BraveSoftware\Brave-Browser - \Torch - \UCBrowser\ - \Blisk - \Epic Privacy Browser - \Nichrome - \Amigo - \Kometa - \Xpom - \Microsoft\Edge - \Liebao7Default\EncryptedStorage - \AVAST Software\Browser - \Kinza - \Mozilla\SeaMonkey\ - \Comodo\IceDragon\ - \8pecxstudios\Cyberfox\ - \FlashPeak\SlimBrowser\ - \Moonchild Productions\Pale Moon\ selection_browser_subpaths: FileName|contains: - \Profiles\ - \User Data selection_cred_files: - FileName|contains: - \Login Data - \Cookies - \EncryptedStorage - \WebCache\ - FileName|endswith: - cert9.db - cookies.sqlite - formhistory.sqlite - key3.db - key4.db - Login Data.sqlite - logins.json - places.sqlite filter_main_img: Image|endswith: - \Sputnik.exe - \ChromePlus.exe - \QIP Surf.exe - \BlackHawk.exe - \7Star.exe - \Sleipnir5.exe - \Citrio.exe - \Chrome SxS.exe - \Chrome.exe - \Coowon.exe - \CocCocBrowser.exe - \Uran.exe - \QQBrowser.exe - \Orbitum.exe - \Slimjet.exe - \Iridium.exe - \Vivaldi.exe - \Chromium.exe - \GhostBrowser.exe - \CentBrowser.exe - \Xvast.exe - \Chedot.exe - \SuperBird.exe - \360Browser.exe - \360Chrome.exe - \dragon.exe - \brave.e
Near-miss passage: Sigma rule: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do. Logsource: windows / process_creation. Rule: title: Remote File Download Via Desktopimgdownldr Utility id: 214641c2-c579-4ecb-8427-0cf19df6842e status: test description: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. references: - https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \desktopimgdownldr.exe ParentImage|endswith: \desktopimgdownldr.exe CommandLine|contains: /lockscreenurl:http condition: selection falsepositives: - Unknown level: medium