Access to Browser Credentials from Suspicious Memory

[rule]
description = """
Identifies access attempt to web browser's credential store data and from a memory region with suspicious properties.
Adversaries may steal credentials from web browsers by reading files specific to the target browser.
"""
id = "808395cd-fb50-4eba-846c-aabcf212c256"
license = "Elastic License v2"
name = "Access to Browser Credentials from Suspicious Memory"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
    "https://www.elastic.co/security-labs/detect-credential-access",
    "https://www.elastic.co/security-labs/upping-the-ante-detecting-in-memory-threats-with-kernel-call-stacks",
]
version = "1.0.41"

query = '''
file where event.type == "access" and process.pid != 4 and
 process.executable != null and process.name != null and event.outcome == "success" and
 process.thread.Ext.call_stack_summary != null and
  (
   file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or
    file.path :
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
  ) and
    (
      /* Abnormal private bytes allocation for the dropped PE when loaded in memory */
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.allocation_private_bytes >= 100000) or

      process.thread.Ext.call_stack_contains_unbacked == true or

      process.thread.Ext.call_stack_summary : "*python*.dll*"
    ) and

    not (process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
         process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
         process.thread.Ext.call_stack_summary :
            ("*mscorlib.dll*", "*|clr.dll*", "*coreclr.dll*", "*mscoreei.dll*", "*mscoree.dll*", "*system.ni.dll*",
             "*mscorlib.ni.dll*", "*mscorwks.dll*", "*mscorsvc.dll*", "*system.private.corelib.dll*", "*system.data.ni.dll*")) and
    not (process.code_signature.subject_name == "Guardicore Ltd" and process.code_signature.status == "errorExpired") and
    not (process.code_signature.trusted == true and
         process.code_signature.subject_name :
                                ("Trichilia Consultants Limited", "Bitdefender SRL", "Opera Norway AS", "FireEye, Inc.",
                                 "Mozilla Corporation", "Google LLC", "Rapid7 LLC", "Cybereason, Inc", "Watchdata Technologies Pte. Ltd.", 
                                 "Cylance, Inc.", "Bromium, Inc.", "ONELAUNCH TECHNOLOGIES INC.", "philandro Software GmbH", 
                                 "Eric R. Zimmerman", "CISCO SYSTEMS CANADA CO", "Cisco Systems, Inc.", "Fiserv", "Fiserv, Inc.", 
                                 "Garmin International, Inc.", "AVG Technologies USA, LLC", "Senior Sistemas S/A", "TEAMDEV LTD.",
                                 "Spotify AB", "SIV - Service für Informationsverarbeitung AG", "Postman, Inc.",
                                 "Tencent Technology (Shenzhen) Company Limited", "Doist Inc.", "GAIJIN NETWORK LTD",
                                 "Beijing Qihu Technology Co., Ltd.", "OpenJS Foundation", "Figma, Inc.", "LogMeIn, Inc.", "Agilebits",
                                 "Canva", "AnyDesk Software GmbH", "Arduino SA", "Lenovo", "Wavesor Software (Eightpoint Technologies Ltd. SEZC)",
                                 "Sabre Glbl Inc.", "WorkingGreen B.V.", "Dedalus Italia S.P.A.", "Cisco WebEx LLC", "Shift Technologies Inc.",
                                 "Vivaldi Technologies AS", "CYNET SECURITY LTD", "Cisco Systems, Inc.", "Adobe Inc.", "Kaseya Holdings Inc",
                                 "London Jamocha Community CIC", "MUSARUBRA US LLC", "HP Inc.", "SAP SE", "JetBrains s.r.o.", "Exclaimer Ltd",
                                 "Absolute Software Corp.", "YANDEX LLC", "timeBro GmbH", "TeamDev Management*", "Zhuhai Kingsoft Office Software Co., Ltd.",
                                 "Sky International AG", "Reason Cybersecurity Inc.", "SnelStart Software B.V.", "7270356 Canada Inc.", "Andrew Ziem",
                                 "Grammarly, Inc.", "ESET, spol. s r.o.", "memtime GmbH", "Code Systems Corporation")) and
    not (process.code_signature.trusted == true and process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not process.executable :
                ("?:\\Program Files (x86)\\VMware\\Plug-in Service\\certutil.exe",
                 "?:\\Program Files (x86)\\Haystack Software\\Arq 5\\ArqAgent.exe",
                 "C:\\Program Files (x86)\\EDconnect8\\EDconnect8.exe",
                 "C:\\Program Files (x86)\\Sage\\Sage HRMS Client\\Abra32.exe",
                 "C:\\Program Files\\Datacard\\TruCredential\\CaptureManager\\bin\\Datacard.DCCM.CaptureManager.exe") and
    not (user.id : "S-1-5-18" and
         process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
    not process.name : "powershell.exe" and
    not (process.executable : "C:\\Windows\\Sys*\\msiexec.exe" and user.id == "S-1-5-18") and
    not process.thread.Ext.call_stack_summary : ("*mscorlib.ni.dll|Unbacked*") and
    not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "Unbacked*" and
                    $entry.callsite_trailing_bytes :
                        ("48890665488b1425300000008b5268488bcb41ff542420488b064903e6eb17488bcb41ff5424384883f8087e06488b46f8eb034833c04883c420415e415c5f5e",
                         "4c8b5424500bc00f85a600000041807a02000f849700000041807a02017409418b4274e98b000000410fb74272415241ff726841ff726041ff725841ff725041")) and
    not (process.executable : "?:\\Users\\*\\AppData\\Local\\Programs\\WebSGD\\certutil.exe" and file.name : ("cert?.db", "key?.db")) and 
    not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("?:\\Program Files\\*.dll*",
                                           "?:\\Program Files (x86)\\*.dll*",
                                           "?:\\windows\\system32\\*\\tmmon*.dll*",
                                           "?:\\Windows\\SysWOW64\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\esensordbi.dll*",
                                           "?:\\Windows\\System32\\umppc*.dll*",
                                           "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                                           "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*",
                                           "?:\\windows\\system32\\hmpalert.dll*",
                                           "\\Device\\Mup\\*",
                                           "*\\msedge.dll!argon2_encodedlen*",
                                           "?:\\Windows\\eMweb\\softokn3.dll*")) and
    not file.path :
             ("?:\\Users\\*\\AppData\\Roaming\\arduino-ide\\Local State",
              "?:\\users\\*\\ebwebview\\local state",
              "?:\\users\\*\\ebwebview\\default\\login data",
              "?:\\Users\\*\\chrome-device\\Default\\Login Data",
              "?:\\users\\*\\ebwebview\\*\\login data",
              "?:\\Users\\*_tools_chrome_device.*", 
              "?:\\Users\\*\\AppData\\Local\\Temp\\sunapsis-jxbrowser\\*\\Login Data") and
    not process.thread.Ext.call_stack_summary like
                      ("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|*",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
                       "ntdll.dll|kernelbase.dll|userenv.dll|profsvc.dll|rpcrt4.dll|*",
                       "ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|libwautils.dll|libwalocal.dll|libwautils.dll|libwaapi.dll|Unbacked|coreclr.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|clr.dll|mscoreei.dll|mscoree.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|tmmon.dll|Unbacked|kernelbase.dll|aclayers.dll|*",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|Unbacked|clr.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browserdefmgr.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|kernelbase.dll|mscorlib.ni.dll|system.management.automation.ni.dll|microsoft.powershell.commands.management.ni.dll|system.management.automation.ni.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|Unbacked|clr.dll|kernel32.dll|ntdll.dll",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|clr.dll|mscorlib.ni.dll|system.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|Unbacked",
                       "ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.onlineid.dll|ntdll.dll|kernel32.dll|ntdll.dll")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"