Access Attempt to Non Existing Cryptocurrency Wallet

[rule]
description = """
Identifies access attempts to non existing cryptocurrency wallet files. Adversaries may perform discovery to steal
potential cryptocurrency related files for for financial gains.
"""
id = "ae071666-e38b-4309-9714-0d014befa01e"
license = "Elastic License v2"
name = "Access Attempt to Non Existing Cryptocurrency Wallet"
os_list = ["windows"]
version = "1.0.7"

query = '''
file where event.type == "access" and process.pid != 4 and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 event.outcome == "failure" and process.executable != null and not file.name : "desktop.ini" and
   file.path :
      ("*\\ElectronCash\\wallets*",
       "*\\Electrum-LTC\\wallets*",
       "*\\Electrum\\wallets*",
       "*\\Ethereum\\keystore*",
       "*\\Exodus\\exodus.wallet*",
       "*\\Bitcoin\\wallets*",
       "*\\Coinomi\\wallets*",
       "*\\Appdata\\Roaming\\Raven\\*wallet*",
       "*\\DaedalusMainnet\\wallets*",
       "*\\Blockstream\\Green\\wallets*",
       "*\\MultiDoge\\multidoge.wallet*",
       "*\\WalletWasabi\\Client\\Wallets*",
       "*\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
       "*\\Appdata\\Roaming\\atomic\\LocalStorage\\leveldb*",
       "*AppData\\Roaming\\Guarda\\LocalStorage\\leveldb*",
       "*fhbohimaelbohpjbbldcngcnapndodjp*",
       "*aeachknmefphepccionboohckonoeemg*",
       "*hnfanknocfeofbddgcijnmhnfnkdnaad*",
       "*hifafgmccdpekplomjjkcfgodnhcellj*",
       "*nkbihfbeogaeaoehlefnkodbefgpgknn*",
       "*ejbalbakoplchlghecdalmeeeajnimhm*",
       "*bfnaelmomeimhlpmgjnjophhpkkoljpa*",
       "*fnjhmkhhmkbjkkabndcnnogagogbneec*",
       "ibnejdfjmmkpcnlpebklmnkoeoihofec*",
       "*klfhbdnlcfcaccoakhceodhldjojboga*",
       "*aanjhgiamnacdfnlfnmgehjikagdbafd*",
       "*bblmcdckkhkhfhhpfcchlpalebmonecp*",
       "*hpglfhgfnhbgpjdenjgmdgoeiappafln*",
       "*afbcbjpbpfadlkmhmclhkeeodmamcflc*",
       "*kncchdigobghenbbaddojjnnaogfppfj*") and
not (process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" and
     process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) and
not process.executable : "?:\\Windows\\explorer.exe" and
not (process.code_signature.subject_name : ("Exodus Movement Inc", "Exodus Movement, Inc.", "Blockstream USA Corp") and process.code_signature.trusted == true and
     file.path : "?:\\Users\\*\\Exodus\\exodus.wallet*") and
not (process.executable == "C:\\Program Files\\WasabiWallet\\wassabee.exe" and file.name == "Wallet.json.old")
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.1.0"