Crypto Wallet or Web Browser File Access via Python

[rule]
description = """
Detects when Python accesses crypto wallet or web browser files on a macOS system like crypto wallet files, or web
browser cookies.
"""
id = "cb8feeee-02f4-43bc-a836-4e510382acd3"
license = "Elastic License v2"
name = "Crypto Wallet or Web Browser File Access via Python"
os_list = ["macos"]
version = "1.0.6"

query = '''
file where event.action == "open" and (process.name like~ "python*" or Effective_process.name like~ "python*") and 
 (file.path like~ ("/Users/*/.electrum/*",
                   "/Users/*/Library/Application_Support/*/Default/Extensions/*",
                   "/Users/*/Library/Application Support/*/Default/Local Extension Settings/*",
                   "/Users/*/Library/Application Support/Electrum/*",
                   "/Users/*/Library/Application Support/Exodus/*", 
                   "/Users/*/Library/Application Support/Coinomi/*",
                   "/Users/*/Library/Application Support/Atomic/*",
                   "/Users/*/Library/Application Support/@trezor/*",
                   "/Users/*/Library/Application Support/Ledger Live/*",
                   "/Users/*/Library/Application Support/WasabiWallet/*",
                   "/Users/*/Monero/*",
                   "/Users/*/Library/Application Support/Bitcoin/*",
                   "/Users/*/Library/Application Support/Litecoin/*",
                   "/Users/*/Library/Application Support/DashCore/*",
                   "/Users/*/Library/Application Support/ElectronCash/*",
                   "/Users/*/Library/Application Support/Guarda/*",
                   "/Users/*/Library/Application Support/Dogecoin/*",
                   "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/BraveWallet/*",
                   "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/Default/Local Extension Settings/pgojbichloddijphfmfhhfolimnhjklk/*",
                   "/Users/*/Library/Application Support/Firefox/Profiles/*/extensions/*") or
   file.name like~ ("cookies.sqlite", 
                    "key?.db", 
                    "logins.json", 
                    "Cookies", 
                    "Cookies.binarycookies", 
                    "Login Data")) and
   not file.path like "/Users/*/Library/Application Support/Slack/Cookies" and
   not Effective_process.executable like "/Applications/Vorta.app/Contents/MacOS/vorta-darwin"
'''

min_endpoint_version = "8.11.1"
optional_actions = []
[[actions]]
action = "kill_process"
field = "Effective_process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.11.1"