Query: rule covering Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a
Matching passage: Sigma rule: Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a. Logsource: windows / file_access. Rule: title: Suspicious File Access to Browser Credential Storage id: a1dfd976-4852-41d4-9507-dc6590a3ccd0 status: experimental description: 'Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware. ' references: - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore date: 2025-05-22 tags: - attack.credential-access - attack.t1555.003 - attack.discovery - attack.t1217 logsource: category: file_access product: windows detection: selection_browser_paths: FileName|contains: - \Sputnik\Sputnik - \MapleStudio\ChromePlus - \QIP Surf - \BlackHawk - \7Star\7Star - \CatalinaGroup\Citrio - \Google\Chrome - \Coowon\Coowon - \CocCoc\Browser - \uCozMedia\Uran - \Tencent\QQBrowser - \Orbitum - \Slimjet - \Iridium - \Vivaldi - \Chromium - \GhostBrowser - \CentBrowser - \Xvast - \Chedot - \SuperBird - \360Browser\Browser - \360Chrome\Chrome - \Comodo\Dragon - \BraveSoftware\Brave-Browser - \Torch - \UCBrowser\ - \Blisk - \Epic Privacy Browser - \Nichrome - \Amigo - \Kometa - \Xpom - \Microsoft\Edge - \Liebao7Default\EncryptedStorage - \AVAST Software\Browser - \Kinza - \Mozilla\SeaMonkey\ - \Comodo\IceDragon\ - \8pecxstudios\Cyberfox\ - \FlashPeak\SlimBrowser\ - \Moonchild Productions\Pale Moon\ selection_browser_subpaths: FileName|contains: - \Profiles\ - \User Data selection_cred_files: - FileName|contains: - \Login Data - \Cookies - \EncryptedStorage - \WebCache\ - FileName|endswith: - cert9.db - cookies.sqlite - formhistory.sqlite - key3.db - key4.db - Login Data.sqlite - logins.json - places.sqlite filter_main_img: Image|endswith: - \Sputnik.exe - \ChromePlus.exe - \QIP Surf.exe - \BlackHawk.exe - \7Star.exe - \Sleipnir5.exe - \Citrio.exe - \Chrome SxS.exe - \Chrome.exe - \Coowon.exe - \CocCocBrowser.exe - \Uran.exe - \QQBrowser.exe - \Orbitum.exe - \Slimjet.exe - \Iridium.exe - \Vivaldi.exe - \Chromium.exe - \GhostBrowser.exe - \CentBrowser.exe - \Xvast.exe - \Chedot.exe - \SuperBird.exe - \360Browser.exe - \360Chrome.exe - \dragon.exe - \brave.e
Near-miss passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: AgentExecutor PowerShell Execution id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 related: - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate level: medium