Browser Debugging from Unusual Parent

[rule]
description = """
Identifies the execution of a Chromium-based browser with the debugging process argument, which may indicate an attempt
to steal authentication cookies. An adversary may steal web application or service session cookies and use them to
access web applications or Internet services as an authenticated user without credentials.
"""
id = "09931e34-fe6b-4155-91ec-490d64fb72a2"
license = "Elastic License v2"
name = "Browser Debugging from Unusual Parent"
os_list = ["windows"]
reference = [
    "https://github.com/defaultnamehere/cookie_crimes",
    "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/",
    "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/chrome_cookies.md",
    "https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e",
    "https://github.com/BishopFox/sliver/wiki/Cursed",
]
version = "1.0.24"

query = '''
process where event.type == "start" and
   process.name : ("chrome.exe", "msedge.exe") and not user.id : "S-1-5-18" and
   process.code_signature.trusted == true and
   process.parent.executable != null and
   process.args : ("--remote-debugging-port=*",
                   "--remote-debugging-targets=*",
                   "--remote-debugging-pipe=*") and
   process.args : "--user-data-dir=*" and not process.args:"--remote-debugging-port=0" and
   not (process.parent.name == "chrome.exe" and process.parent.args == "--remote-debugging-host=127.0.0.1") and
   not process.parent.executable : ("?:\\Program Files\\Microsoft VS Code\\Code.exe",
                                    "?:\\Program Files (x86)\\PRTG Network Monitor\\Sensor System\\reporter.exe",
                                    "?:\\Program Files\\nodejs\\node.exe",
                                    "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
                                    "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
                                    "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
                                    "?:\\Program Files (x86)\\Brackets\\Brackets.exe",
                                    "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
                                    "?:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
                                    "?:\\Program Files\\OutSystems\\Development Environment*\\Service Studio\\ServiceStudio.exe",
                                    "?:\\Program Files (x86)\\CyberArk\\PSM\\Components\\chromedriver.exe",
                                    "?:\\Program Files\\Microsoft Visual Studio\\*\\node.exe",
                                    "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\node.exe",
                                    "?:\\Program Files (x86)\\Price Pro\\PricePro.exe",
                                    "?:\\Users\\*\\Versioning_SPCRepository\\SPCProcessor\\SPCEngine\\app.exe",
                                    "E:\\PRTG\\Sensor System\\reporter.exe" ,
                                    "E:\\eclipse\\chromedriver.exe",
                                    "c:\\ibi\\AppStudio82\\bin\\chromedriver.exe",
                                    "C:\\Windows\\chromedriver.exe",
                                    "?:\\Program Files\\Google\\Chrome Dev\\Application\\chrome.exe",
                                    "?:\\ibi\\AppStudio90\\bin\\chromedriver.exe",
                                    "?:\\Users\\*\\AppData\\Roaming\\nvm\\v*\\node.exe",
                                    "?:\\*\\bin\\cache\\dart-sdk\\bin\\dart.exe",
                                    "C:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
                                    "C:\\Program Files\\Python3??\\python.exe") and
   not (process.parent.executable : "?:\\Windows\\explorer.exe" and process.command_line : "*VisualStudio*") and
   not (process.parent.name : "chromedriver.exe" and process.parent.command_line : "*chromedriver.exe --port=*") and
   not (process.parent.executable : "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" and
        process.parent.command_line : "*--ms-enable-electron-run-as-node*") and
   not (process.parent.name : "node.exe" and process.parent.args : "--code-coverage") and
   not process.args :
             ("--user-data-dir=?:\\Users\\*\\AppData\\Local\\JetBrains\\WebStorm*\\chrome-user-data-*",
              "--user-data-dir=?:\\Users\\*\\AppData\\Local\\Temp\\1\\flutter_tools.*\\flutter_tools_chrome_device.*") and
   not process.parent.args : "?:\\Program Files\\nodejs\\node.exe" and
   not (process.parent.code_signature.subject_name == "Google LLC" and process.parent.code_signature.trusted == true)
'''

min_endpoint_version = "8.14.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.14.0"