Crypto Wallet or Web Browser File Access via Nodejs

[rule]
description = """
Detects when Node accesses crypto wallet or web browser files on a macOS system like crypto wallet files, or web browser
cookies. Malware like "BeaverTail", "InvisibleFerret", or "OtterCookie" all use malicious Node applications that
implement stealer functionality capable of grabbing sensitive files and exfiltrating them from a victim system.
"""
id = "555ec79a-b570-455e-aac9-d2df587d70bf"
license = "Elastic License v2"
name = "Crypto Wallet or Web Browser File Access via Nodejs"
os_list = ["macos"]
version = "1.0.4"

query = '''
file where event.action == "open" and (process.name == "node" or Effective_process.name == "node") and 
 (file.path like~ ("/Users/*/.electrum/*",
                   "/Users/*/Library/Application_Support/*/Default/Extensions/*",
                   "/Users/*/Library/Application Support/*/Default/Local Extension Settings/*",
                   "/Users/*/Library/Application Support/Electrum/*",
                   "/Users/*/Library/Application Support/Exodus/*", 
                   "/Users/*/Library/Application Support/Coinomi/*",
                   "/Users/*/Library/Application Support/Atomic/*",
                   "/Users/*/Library/Application Support/@trezor/*",
                   "/Users/*/Library/Application Support/Ledger Live/*",
                   "/Users/*/Library/Application Support/WasabiWallet/*",
                   "/Users/*/Monero/*",
                   "/Users/*/Library/Application Support/Bitcoin/*",
                   "/Users/*/Library/Application Support/Litecoin/*",
                   "/Users/*/Library/Application Support/DashCore/*",
                   "/Users/*/Library/Application Support/ElectronCash/*",
                   "/Users/*/Library/Application Support/Guarda/*",
                   "/Users/*/Library/Application Support/Dogecoin/*",
                   "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/BraveWallet/*",
                   "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/Default/Local Extension Settings/pgojbichloddijphfmfhhfolimnhjklk/*",
                   "/Users/*/Library/Application Support/Firefox/Profiles/*/extensions/*") or
   file.name like~ ("cookies.sqlite", 
                    "key?.db", 
                    "logins.json", 
                    "Cookies", 
                    "Cookies.binarycookies", 
                    "Login Data"))
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"