Detection rules › Elastic
Failed Access Attempt to Web Browser Files
Identifies a failed access attempt to web browser's credential store data. Adversaries may steal credentials from web browsers by reading files specific to the target browser.
MITRE ATT&CK coverage
Rule body
[rule]
description = """
Identifies a failed access attempt to web browser's credential store data. Adversaries may steal credentials from web
browsers by reading files specific to the target browser.
"""
id = "ebbb46d3-eb7f-4247-88fe-9bc5525443b3"
license = "Elastic License v2"
name = "Failed Access Attempt to Web Browser Files"
os_list = ["windows"]
reference = [
"https://www.elastic.co/security-labs/globally-distributed-stealers",
"https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.37"
query = '''
file where event.type == "access" and event.outcome == "failure" and process.pid != 4 and user.id != "S-1-5-18" and
process.executable != null and process.thread.Ext.call_stack_summary != null and
(
file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or
file.path :
("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
"?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
) and
not (file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\*" and
process.executable : "?:\\Windows\\System32\\PrintIsolationHost.exe") and
not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and user.id : "S-1-5-18") and
not (process.code_signature.subject_name :
("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "TPZ SOLUCOES DIGITAIS LTDA",
"Bitdefender SRL", "Ivanti, Inc.", "McAfee, Inc.", "Fortinet Technologies*", "Zscaler, Inc.", "Bromium, Inc.",
"Duck Duck Go, Inc.", "Galactic Advisors, Inc.", "Kaspersky Lab JSC", "3Dconnexion SAM", "Opera Norway AS",
"Dashlane", "TeamDev Ltd.", "Mobatek", "Shift Technologies Inc.", "Nextron Systems GmbH",
"Wavesor Software (Eightpoint Technologies Ltd. SEZC)", "Viber Media S.a r.l.", "Eric R. Zimmerman",
"SAP SE", "Vivaldi Technologies AS", "ONELAUNCH TECHNOLOGIES INC.", "SentinelOne Inc.", "Brave Software, Inc.",
"Overwolf Ltd", "YANDEX LLC", "Keeper Security Inc.", "Dashlane USA, Inc.", "Spotify AB", "Island Technology Inc.",
"Zoom Video Communications, Inc.", "Emsisoft Ltd", "REVERSO S.A.S.", "Zoom Video Communications, Inc.",
"TeamDev Ltd.", "TeamDev Management*", "Fabrice PARISOT", "Beijing Qihu Technology Co., Ltd.", "timeBro GmbH",
"Lenovo", "7270356 Canada Inc.", "VS REVO GROUP OOD", "Jio Platforms Limited", "Zhuhai Kingsoft Office Software Co., Ltd.",
"Adaware Software (7270356 CANADA INC.)", "Google Inc", "SweetLabs Inc", "Avast Software s.r.o.", "Athenahealth, Inc.",
"Tencent Technology (Shenzhen) Company Limited", "AOMEI International Network Limited", "Lavasoft Software Canada Inc.",
"memtime GmbH", "Grammarly, Inc.", "Sunstream Labs (Capital Intellect Inc.)", "Echo Infini Sdn. Bhd.", "Matrix42 AG",
"Sunstream Labs (Capital Intellect Inc.)", "OneStart Technologies LLC", "Grammarly, Inc.", "Canva", "PERPLEXITY AI, INC.",
"salesforce.com, inc.", "Matrix42 AG", "BlazerBrowser.com LLC", "BROWSERWORKS LTD", "Exclaimer Ltd", "BrowseAI LLC") and
process.code_signature.trusted == true) and
not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\BingSvc\\BingSvc.exe" and process.code_signature.trusted == true and
process.code_signature.subject_name == "Microsoft Corporation") and
not process.executable : ("?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"?:\\Windows\\System32\\cleanmgr.exe",
"?:\\Windows\\System32\\cmimageworker.exe",
"?:\\Windows\\System32\\igfxext.exe",
"?:\\Windows\\SysWOW64\\SearchIndexer.exe",
"?:\\Windows\\SysWOW64\\msiexec.exe",
"?:\\Windows\\System32\\msiexec.exe",
"C:\\Windows\\System32\\RuntimeBroker.exe",
"C:\\Windows\\System32\\taskhostw.exe",
"C:\\Windows\\System32\\MoUsoCoreWorker.exe",
"\\Device\\Mup\\*",
"?:\\Windows\\explorer.exe",
"?:\\Windows\\CCM\\CcmExec.exe",
"?:\\Windows\\System32\\cmd.exe",
"?:\\Windows\\System32\\dllhost.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\System32\\SearchProtocolHost.exe",
"?:\\Users\\*e\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
"?:\\Users\\*\\AppData\\Local\\Carbonate\\Carbonate\\Application\\Carbonate.exe",
"C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe") and
not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable : "?:\\Windows\\System32\\svchost.exe") and
not process.executable :
("?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
not (process.name : "certutil.exe" and file.extension : "db") and
not file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\GoogleChromePortable\\profile\\Default\\Login Data" and
not process.thread.Ext.call_stack_summary :
("ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
not (process.name : "chrome.exe" and
file.path : ("?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\LOGIN DATA")) and
not file.path : ("?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\UNGOOGLED-CHROMIUM-PORTABLE\\DATA\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\Users\\*\\chrome-device\\Default\\Login Data",
"?:\\Users\\*\\EBWebView\\Default\\Login Data",
"?:\\Users\\*\\Favorites\\BOOKMARKS\\Default\\Login Data",
"?:\\USERS\\*\\APPDATA\\LOCAL\\ELROND\\MAIAR\\USER DATA\\DEFAULT\\LOGIN DATA",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Default BackupDD\\Login Data",
"?:\\Users\\*\\Favorites\\bookmarks\\Default\\Login Data",
"?:\\users\\*\\mayanks\\JxBrowserData\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Local\\pc_app_store\\User Data\\Default\\*",
"?:\\Users\\*\\AppData\\Local\\Melvor Idle\\User Data\\Default\\*",
"?:\\Users\\*\\AppData\\Local\\Streaming\\User Data\\Default\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\BETAFLIGHT-CONFIGURATOR\\USER DATA\\DEFAULT\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\LEADING\\USER DATA\\DEFAULT\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\*",
"?:\\Users\\*\\AppData\\Local\\Uniflash\\User Data\\Default\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\*",
"?:\\users\\*\\appdata\\local\\Market Axess\\Data\\*\\mayanks\\JxBrowserData\\Default\\*",
"?:\\Users\\*\\AppData\\Local\\Temp\\flutter_tools.*\\flutter_tools_chrome_device.*\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Local\\*\\EBWebView\\Snapshots\\*\\Default\\Login Data",
"?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\SNAPSHOTS\\*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\EBWEBVIEW\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\ALS_JXBROWSER_CONTEXT_*\\LOGIN DATA",
"?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\BaseLayer\\Files\\Users\\WDAGUtilityAccount\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data") and
not process.thread.Ext.call_stack_summary like
("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|hmpalert.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|*",
"ntdll.dll|kernelbase.dll|shift.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|msedge.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|defaultpackoffer.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|appvisvsubsystems32.dll|kernelbase.dll|hmpalert.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|qipcap.dll|cmd.exe|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.dll|*",
"ntdll.dll|kernelbase.dll|procexp64.exe|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|appvisvsubsystems32.dll|kernelbase.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|filesyncsessions.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|fluencyds.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|dsadmin.dll|dsuiext.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|microsoft.sharepoint.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|spark-windows-desktop-ui.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|*")
'''
min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.7.0"
Stages and Predicates
Stage 1: file
file where event.type == "access" and event.outcome == "failure" and process.pid != 4 and user.id != "S-1-5-18" and
process.executable != null and process.thread.Ext.call_stack_summary != null and
(
file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or
file.path :
("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
"?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
) and
not (file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\*" and
process.executable : "?:\\Windows\\System32\\PrintIsolationHost.exe") and
not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and user.id : "S-1-5-18") and
not (process.code_signature.subject_name :
("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "TPZ SOLUCOES DIGITAIS LTDA",
"Bitdefender SRL", "Ivanti, Inc.", "McAfee, Inc.", "Fortinet Technologies*", "Zscaler, Inc.", "Bromium, Inc.",
"Duck Duck Go, Inc.", "Galactic Advisors, Inc.", "Kaspersky Lab JSC", "3Dconnexion SAM", "Opera Norway AS",
"Dashlane", "TeamDev Ltd.", "Mobatek", "Shift Technologies Inc.", "Nextron Systems GmbH",
"Wavesor Software (Eightpoint Technologies Ltd. SEZC)", "Viber Media S.a r.l.", "Eric R. Zimmerman",
"SAP SE", "Vivaldi Technologies AS", "ONELAUNCH TECHNOLOGIES INC.", "SentinelOne Inc.", "Brave Software, Inc.",
"Overwolf Ltd", "YANDEX LLC", "Keeper Security Inc.", "Dashlane USA, Inc.", "Spotify AB", "Island Technology Inc.",
"Zoom Video Communications, Inc.", "Emsisoft Ltd", "REVERSO S.A.S.", "Zoom Video Communications, Inc.",
"TeamDev Ltd.", "TeamDev Management*", "Fabrice PARISOT", "Beijing Qihu Technology Co., Ltd.", "timeBro GmbH",
"Lenovo", "7270356 Canada Inc.", "VS REVO GROUP OOD", "Jio Platforms Limited", "Zhuhai Kingsoft Office Software Co., Ltd.",
"Adaware Software (7270356 CANADA INC.)", "Google Inc", "SweetLabs Inc", "Avast Software s.r.o.", "Athenahealth, Inc.",
"Tencent Technology (Shenzhen) Company Limited", "AOMEI International Network Limited", "Lavasoft Software Canada Inc.",
"memtime GmbH", "Grammarly, Inc.", "Sunstream Labs (Capital Intellect Inc.)", "Echo Infini Sdn. Bhd.", "Matrix42 AG",
"Sunstream Labs (Capital Intellect Inc.)", "OneStart Technologies LLC", "Grammarly, Inc.", "Canva", "PERPLEXITY AI, INC.",
"salesforce.com, inc.", "Matrix42 AG", "BlazerBrowser.com LLC", "BROWSERWORKS LTD", "Exclaimer Ltd", "BrowseAI LLC") and
process.code_signature.trusted == true) and
not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\BingSvc\\BingSvc.exe" and process.code_signature.trusted == true and
process.code_signature.subject_name == "Microsoft Corporation") and
not process.executable : ("?:\\Program Files (x86)\\*.exe",
"?:\\Program Files\\*.exe",
"?:\\Windows\\System32\\cleanmgr.exe",
"?:\\Windows\\System32\\cmimageworker.exe",
"?:\\Windows\\System32\\igfxext.exe",
"?:\\Windows\\SysWOW64\\SearchIndexer.exe",
"?:\\Windows\\SysWOW64\\msiexec.exe",
"?:\\Windows\\System32\\msiexec.exe",
"C:\\Windows\\System32\\RuntimeBroker.exe",
"C:\\Windows\\System32\\taskhostw.exe",
"C:\\Windows\\System32\\MoUsoCoreWorker.exe",
"\\Device\\Mup\\*",
"?:\\Windows\\explorer.exe",
"?:\\Windows\\CCM\\CcmExec.exe",
"?:\\Windows\\System32\\cmd.exe",
"?:\\Windows\\System32\\dllhost.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\Robocopy.exe",
"?:\\Windows\\System32\\SearchProtocolHost.exe",
"?:\\Users\\*e\\AppData\\Local\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
"?:\\Users\\*\\AppData\\Local\\Carbonate\\Carbonate\\Application\\Carbonate.exe",
"C:\\Windows\\UUS\\Packages\\Preview\\amd64\\MoUsoCoreWorker.exe") and
not (user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.executable : "?:\\Windows\\System32\\svchost.exe") and
not process.executable :
("?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
not (process.name : "certutil.exe" and file.extension : "db") and
not file.path : "?:\\Users\\*\\AppData\\Local\\Temp\\GoogleChromePortable\\profile\\Default\\Login Data" and
not process.thread.Ext.call_stack_summary :
("ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll") and
not (process.name : "chrome.exe" and
file.path : ("?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\LOGIN DATA")) and
not file.path : ("?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\UNGOOGLED-CHROMIUM-PORTABLE\\DATA\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\PUPPETEER_DEV_CHROME_PROFILE-*\\DEFAULT\\LOGIN DATA",
"?:\\Users\\*\\chrome-device\\Default\\Login Data",
"?:\\Users\\*\\EBWebView\\Default\\Login Data",
"?:\\Users\\*\\Favorites\\BOOKMARKS\\Default\\Login Data",
"?:\\USERS\\*\\APPDATA\\LOCAL\\ELROND\\MAIAR\\USER DATA\\DEFAULT\\LOGIN DATA",
"?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Default BackupDD\\Login Data",
"?:\\Users\\*\\Favorites\\bookmarks\\Default\\Login Data",
"?:\\users\\*\\mayanks\\JxBrowserData\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Local\\pc_app_store\\User Data\\Default\\*",
"?:\\Users\\*\\AppData\\Local\\Melvor Idle\\User Data\\Default\\*",
"?:\\Users\\*\\AppData\\Local\\Streaming\\User Data\\Default\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\BETAFLIGHT-CONFIGURATOR\\USER DATA\\DEFAULT\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\LEADING\\USER DATA\\DEFAULT\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\CHROMIUM\\USER DATA\\DEFAULT\\*",
"?:\\Users\\*\\AppData\\Local\\Uniflash\\User Data\\Default\\*",
"?:\\USERS\\*\\APPDATA\\LOCAL\\PGADMIN4\\USER DATA\\DEFAULT\\*",
"?:\\users\\*\\appdata\\local\\Market Axess\\Data\\*\\mayanks\\JxBrowserData\\Default\\*",
"?:\\Users\\*\\AppData\\Local\\Temp\\flutter_tools.*\\flutter_tools_chrome_device.*\\Default\\Login Data",
"?:\\Users\\*\\AppData\\Local\\*\\EBWebView\\Snapshots\\*\\Default\\Login Data",
"?:\\USERS\\*\\APPDATA\\ROAMING\\BURPSUITE\\PRE-WIRED-BROWSER\\SNAPSHOTS\\*\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\EBWEBVIEW\\DEFAULT\\LOGIN DATA",
"?:\\USERS\\*\\APPDATA\\LOCAL\\TEMP\\ALS_JXBROWSER_CONTEXT_*\\LOGIN DATA",
"?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\BaseLayer\\Files\\Users\\WDAGUtilityAccount\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data") and
not process.thread.Ext.call_stack_summary like
("ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|hmpalert.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|*",
"ntdll.dll|kernelbase.dll|shift.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|kernelbase.dll|msedge.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|defaultpackoffer.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|appvisvsubsystems32.dll|kernelbase.dll|hmpalert.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|qipcap.dll|cmd.exe|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.dll|*",
"ntdll.dll|kernelbase.dll|procexp64.exe|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|kernel32.dll|ntdll.dll",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|appvisvsubsystems32.dll|kernelbase.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|filesyncsessions.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|fluencyds.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|dsadmin.dll|dsuiext.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|microsoft.sharepoint.dll|*",
"ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|spark-windows-desktop-ui.dll|*",
"ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|*")
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
file.extension | eq | db | excludes:file.extension field:"file.extension" value:"db" |
process.name | eq | certutil.exe | excludes:process.name field:"process.name" value:"certutil.exe" |
file.path | starts_with | ?:\Windows\System32\spool\drivers\x64\ | excludes:file.path field:"file.path" value:"?:\Windows\System32\spool\drivers\x64\" |
process.executable | eq | ?:\Windows\System32\PrintIsolationHost.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\System32\PrintIsolationHost.exe" |
file.path | wildcard | ?:\USERS\*\APPDATA\LOCAL\TEMP\PUPPETEER_DEV_CHROME_PROFILE-*\DEFAULT\LOGIN DATA, ?:\USERS\*\APPDATA\LOCAL\TEMP\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\DEFAULT\LOGIN DATA, ?:\USERS\*\APPDATA\LOCAL\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA | excludes:file.path field:"file.path" value:"?:\USERS\*\APPDATA\LOCAL\TEMP\PUPPETEER_DEV_CHROME_PROFILE-*\DEFAULT\LOGIN DATA" field:"file.path" value:"?:\USERS\*\APPDATA\LOCAL\TEMP\PLAYWRIGHT_CHROMIUMDEV_PROFILE-*\DEFAULT\LOGIN DATA" field:"file.path" value:"?:\USERS\*\APPDATA\LOCAL\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" |
process.name | eq | chrome.exe | excludes:process.name field:"process.name" value:"chrome.exe" |
process.code_signature.subject_name | eq | Microsoft Corporation | excludes:process.code_signature.subject_name field:"process.code_signature.subject_name" value:"Microsoft Corporation" |
process.code_signature.trusted | eq | true | excludes:process.code_signature.trusted field:"process.code_signature.trusted" value:"true" |
process.executable | wildcard | C:\Users\*\AppData\Local\Microsoft\BingSvc\BingSvc.exe | excludes:process.executable field:"process.executable" value:"C:\Users\*\AppData\Local\Microsoft\BingSvc\BingSvc.exe" |
process.code_signature.subject_name | wildcard | Rapid7 LLC, Mozilla Corporation, Commvault Systems, Inc., Google LLC, TPZ SOLUCOES DIGITAIS LTDA, Bitdefender SRL, Ivanti, Inc., McAfee, Inc., Fortinet Technologies*, Zscaler, Inc., Bromium, Inc., Duck Duck Go, Inc., Galactic Advisors, Inc., Kaspersky Lab JSC, 3Dconnexion SAM, Opera Norway AS, Dashlane, TeamDev Ltd., Mobatek, Shift Technologies Inc., Nextron Systems GmbH, Wavesor Software (Eightpoint Technologies Ltd. SEZC), Viber Media S.a r.l., Eric R. Zimmerman, SAP SE, Vivaldi Technologies AS, ONELAUNCH TECHNOLOGIES INC., SentinelOne Inc., Brave Software, Inc., Overwolf Ltd, YANDEX LLC, Keeper Security Inc., Dashlane USA, Inc., Spotify AB, Island Technology Inc., Zoom Video Communications, Inc., Emsisoft Ltd, REVERSO S.A.S., Zoom Video Communications, Inc., TeamDev Ltd., TeamDev Management*, Fabrice PARISOT, Beijing Qihu Technology Co., Ltd., timeBro GmbH, Lenovo, 7270356 Canada Inc., VS REVO GROUP OOD, Jio Platforms Limited, Zhuhai Kingsoft Office Software Co., Ltd., Adaware Software (7270356 CANADA INC.), Google Inc, SweetLabs Inc, Avast Software s.r.o., Athenahealth, Inc., Tencent Technology (Shenzhen) Company Limited, AOMEI International Network Limited, Lavasoft Software Canada Inc., memtime GmbH, Grammarly, Inc., Sunstream Labs (Capital Intellect Inc.), Echo Infini Sdn. Bhd., Matrix42 AG, Sunstream Labs (Capital Intellect Inc.), OneStart Technologies LLC, Grammarly, Inc., Canva, PERPLEXITY AI, INC., salesforce.com, inc., Matrix42 AG, BlazerBrowser.com LLC, BROWSERWORKS LTD, Exclaimer Ltd, BrowseAI LLC | excludes:process.code_signature.subject_name |
process.executable | eq | ?:\Windows\System32\svchost.exe | excludes:process.executable field:"process.executable" value:"?:\Windows\System32\svchost.exe" |
user.id | eq | S-1-5-18, S-1-5-19, S-1-5-20 | excludes:user.id field:"user.id" value:"S-1-5-18" field:"user.id" value:"S-1-5-19" field:"user.id" value:"S-1-5-20" |
process.executable | wildcard | ?:\Program Files\*.exe, ?:\Program Files (x86)\*.exe | excludes:process.executable field:"process.executable" value:"?:\Program Files\*.exe" field:"process.executable" value:"?:\Program Files (x86)\*.exe" |
user.id | eq | S-1-5-18 | excludes:user.id field:"user.id" value:"S-1-5-18" |
file.path | wildcard | ?:\USERS\*\APPDATA\ROAMING\BURPSUITE\PRE-WIRED-BROWSER\DEFAULT\LOGIN DATA, ?:\USERS\*\APPDATA\LOCAL\TEMP\PUPPETEER_DEV_CHROME_PROFILE-*\DEFAULT\LOGIN DATA, ?:\USERS\*\APPDATA\LOCAL\PGADMIN4\USER DATA\DEFAULT\LOGIN DATA, ?:\USERS\*\UNGOOGLED-CHROMIUM-PORTABLE\DATA\DEFAULT\LOGIN DATA, ?:\USERS\*\APPDATA\LOCAL\TEMP\PUPPETEER_DEV_CHROME_PROFILE-*\DEFAULT\LOGIN DATA, ?:\Users\*\chrome-device\Default\Login Data, ?:\Users\*\EBWebView\Default\Login Data, ?:\Users\*\Favorites\BOOKMARKS\Default\Login Data, ?:\USERS\*\APPDATA\LOCAL\ELROND\MAIAR\USER DATA\DEFAULT\LOGIN DATA, ?:\Users\*\AppData\Local\Microsoft\Edge\Default BackupDD\Login Data, ?:\Users\*\Favorites\bookmarks\Default\Login Data, ?:\users\*\mayanks\JxBrowserData\Default\Login Data, ?:\Users\*\AppData\Local\pc_app_store\User Data\Default\*, ?:\Users\*\AppData\Local\Melvor Idle\User Data\Default\*, ?:\Users\*\AppData\Local\Streaming\User Data\Default\*, ?:\USERS\*\APPDATA\LOCAL\BETAFLIGHT-CONFIGURATOR\USER DATA\DEFAULT\*, ?:\USERS\*\APPDATA\LOCAL\LEADING\USER DATA\DEFAULT\*, ?:\USERS\*\APPDATA\LOCAL\CHROMIUM\USER DATA\DEFAULT\*, ?:\Users\*\AppData\Local\Uniflash\User Data\Default\*, ?:\USERS\*\APPDATA\LOCAL\PGADMIN4\USER DATA\DEFAULT\*, ?:\users\*\appdata\local\Market Axess\Data\*\mayanks\JxBrowserData\Default\*, ?:\Users\*\AppData\Local\Temp\flutter_tools.*\flutter_tools_chrome_device.*\Default\Login Data, ?:\Users\*\AppData\Local\*\EBWebView\Snapshots\*\Default\Login Data, ?:\USERS\*\APPDATA\ROAMING\BURPSUITE\PRE-WIRED-BROWSER\SNAPSHOTS\*\DEFAULT\LOGIN DATA, ?:\USERS\*\EBWEBVIEW\DEFAULT\LOGIN DATA, ?:\USERS\*\APPDATA\LOCAL\TEMP\ALS_JXBROWSER_CONTEXT_*\LOGIN DATA, ?:\ProgramData\Microsoft\Windows\Containers\BaseImages\*\BaseLayer\Files\Users\WDAGUtilityAccount\AppData\Local\Microsoft\Edge\User Data\Default\Login Data | excludes:file.path |
file.path | wildcard | ?:\Users\*\AppData\Local\Temp\GoogleChromePortable\profile\Default\Login Data | excludes:file.path field:"file.path" value:"?:\Users\*\AppData\Local\Temp\GoogleChromePortable\profile\Default\Login Data" |
process.executable | wildcard | ?:\Program Files (x86)\*.exe, ?:\Program Files\*.exe, ?:\Windows\System32\cleanmgr.exe, ?:\Windows\System32\cmimageworker.exe, ?:\Windows\System32\igfxext.exe, ?:\Windows\SysWOW64\SearchIndexer.exe, ?:\Windows\SysWOW64\msiexec.exe, ?:\Windows\System32\msiexec.exe, C:\Windows\System32\RuntimeBroker.exe, C:\Windows\System32\taskhostw.exe, C:\Windows\System32\MoUsoCoreWorker.exe, \Device\Mup\*, ?:\Windows\explorer.exe, ?:\Windows\CCM\CcmExec.exe, ?:\Windows\System32\cmd.exe, ?:\Windows\System32\dllhost.exe, ?:\Windows\System32\svchost.exe, ?:\Windows\System32\Robocopy.exe, ?:\Windows\System32\SearchProtocolHost.exe, ?:\Users\*e\AppData\Local\Microsoft\EdgeWebView\Application\*\msedgewebview2.exe, ?:\Users\*\AppData\Local\Microsoft\Edge SxS\Application\msedge.exe, ?:\Users\*\AppData\Local\Microsoft\Edge\Application\msedge.exe, ?:\Users\*\AppData\Local\Carbonate\Carbonate\Application\Carbonate.exe, C:\Windows\UUS\Packages\Preview\amd64\MoUsoCoreWorker.exe | excludes:process.executable |
process.executable | wildcard | ?:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe, ?:\ProgramData\Microsoft\Windows Defender\Platform\*\MsMpEng.exe, ?:\ProgramData\Microsoft\Windows Defender\Platform\*\MpCopyAccelerator.exe | excludes:process.executable field:"process.executable" value:"?:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\*\MsSense.exe" field:"process.executable" value:"?:\ProgramData\Microsoft\Windows Defender\Platform\*\MsMpEng.exe" field:"process.executable" value:"?:\ProgramData\Microsoft\Windows Defender\Platform\*\MpCopyAccelerator.exe" |
process.thread.Ext.call_stack_summary | eq | ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll, ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll | excludes:process.thread.Ext.call_stack_summary field:"process.thread.Ext.call_stack_summary" value:"ntdll.dll|kernelbase.dll|hmpalert.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll" field:"process.thread.Ext.call_stack_summary" value:"ntdll.dll|pghook.dll|kernelbase.dll|hmpalert.dll|pcpksp.dll|ncrypt.dll|crypt32.dll|aadtb.dll|threadpoolwinrt.dll|ntdll.dll|kernel32.dll|ntdll.dll" |
process.thread.Ext.call_stack_summary | wildcard | ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|browsersettings.dll|kernel32.dll|ntdll.dll, ntdll.dll|kernelbase.dll|hmpalert.dll|*, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|*, ntdll.dll|kernelbase.dll|shift.dll|kernel32.dll|ntdll.dll, ntdll.dll|kernelbase.dll|msedge.dll|kernel32.dll|ntdll.dll, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|rsaenh.dll|cryptsp.dll|*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|defaultpackoffer.dll|*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|appvisvsubsystems32.dll|kernelbase.dll|hmpalert.dll|*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|aclayers.dll|*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|qipcap.dll|cmd.exe|kernel32.dll|ntdll.dll, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|acrord32.dll|*, ntdll.dll|kernelbase.dll|procexp64.exe|kernel32.dll|ntdll.dll, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|mso30win32client.dll|mso20win32client.dll|kernel32.dll|ntdll.dll, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|kernelbase.dll|mscorlib.ni.dll|Unbacked|mscorlib.ni.dll|clr.dll|kernel32.dll|ntdll.dll, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|windows.security.authentication.*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|appvisvsubsystems32.dll|kernelbase.dll|*, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|filesyncsessions.dll|*, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|fluencyds.dll|*, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|dsadmin.dll|dsuiext.dll|*, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|microsoft.sharepoint.dll|*, ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|spark-windows-desktop-ui.dll|*, ntdll.dll|wow64.dll|wow64cpu.dll|wow64.dll|ntdll.dll|sophosed.dll|kernelbase.dll|hmpalert.dll|mso20win32client.dll|* | excludes:process.thread.Ext.call_stack_summary |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
event.outcome | eq |
| field:"event.outcome" kind:eq value:"failure" |
event.type | eq |
| field:"event.type" kind:eq value:"access" |
file.name | wildcard |
| field:"file.name" kind:wildcard |
file.path | wildcard |
| field:"TargetFilename" kind:wildcard |
process.executable | is_not_null | field:"Image" kind:is_not_null | |
process.pid | ne |
| field:"process_id" kind:ne value:"4" |
process.thread.Ext.call_stack_summary | is_not_null | field:"process.thread.Ext.call_stack_summary" kind:is_not_null | |
user.id | ne |
| field:"user.id" kind:ne value:"S-1-5-18" |