Crypto Wallet File Access by Unsigned or Untrusted Binary

[rule]
description = """
Detects when a suspicious process attempts to access a crypto wallet sensitive file. This is an alpha version of this
rule and meant to be used to assess and test.
"""
id = "a3050eae-c8ae-434d-aeff-97112eddcb48"
license = "Elastic License v2"
name = "Crypto Wallet File Access by Unsigned or Untrusted Binary"
os_list = ["macos"]
reference = ["https://www.elastic.co/security-labs/beyond-the-wail"]
version = "1.0.19"

query = '''
file where event.action == "open" and 
 file.path like~ ("/Users/*/.electrum/*",
                  "/Users/*/Library/Application_Support/*/Default/Extensions/*",
                  "/Users/*/Library/Application Support/*/Default/Local Extension Settings/*",
                  "/Users/*/Library/Application Support/Electrum/*",
                  "/Users/*/Library/Application Support/Exodus/*", 
                  "/Users/*/Library/Application Support/Coinomi/*",
                  "/Users/*/Library/Application Support/Atomic/*",
                  "/Users/*/Library/Application Support/@trezor/*",
                  "/Users/*/Library/Application Support/Ledger Live/*",
                  "/Users/*/Library/Application Support/WasabiWallet/*",
                  "/Users/*/Monero/*",
                  "/Users/*/Library/Application Support/Bitcoin/*",
                  "/Users/*/Library/Application Support/Litecoin/*",
                  "/Users/*/Library/Application Support/DashCore/*",
                  "/Users/*/Library/Application Support/ElectronCash/*",
                  "/Users/*/Library/Application Support/Guarda/*",
                  "/Users/*/Library/Application Support/Dogecoin/*",
                  "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/BraveWallet/*",
                  "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/Default/Local Extension Settings/pgojbichloddijphfmfhhfolimnhjklk/*",
                  "/Users/*/Library/Application Support/Firefox/Profiles/*/extensions/*") and
  process.executable != null and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and
  not process.code_signature.signing_id : ("rg-*", "git-*", "rg") and
  not process.executable like "/opt/homebrew/Cellar/rtk/*/bin/rtk" and
  not (Effective_process.executable like "/Library/Elastic/Agent/data/elastic-agent-*/elastic-agent.app/Contents/MacOS/elastic-agent" and process.executable like "/Library/Elastic/Agent/data/elastic-agent-*/components/osquery-extension.ext")
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.executable"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"