Potential Browser Credentials Stealer

[rule]
description = """
Identifies the creation of files with names related to web browser's credential store data. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "d154bb87-dc5d-4e6e-8be8-24f631ef09ff"
license = "Elastic License v2"
name = "Potential Browser Credentials Stealer"
os_list = ["windows"]
version = "1.0.4"

query = '''
sequence by process.entity_id with maxspan=1s
[file where event.action == "creation" and process.pid != 4 and process.executable != null and process.name != null and
  not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
  file.name : ("creditcards.db", "passwords.db", "autofilldata.db", "Google_Chome_Default.txt",
              "creditcards.txt", "passwords.txt", "autofilldata.txt", "AutoFill.txt", "Bookmarks.txt", "Cards.txt") and
  not (process.executable : "C:\\Program Files (x86)\\Genesys\\GenesysCloud\\GenesysCloud.exe" and file.name : "passwords.txt")]
[file where event.action == "creation" and process.pid != 4 and process.executable != null and process.name != null and
  not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
  file.name : ("creditcards.db", "passwords.db", "autofilldata.db", "Google_Chome_Default.txt",
               "creditcards.txt", "passwords.txt", "autofilldata.txt", "AutoFill.txt", "Bookmarks.txt", "Cards.txt")]
'''

min_endpoint_version = "8.1.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"


[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.1.0"