Suspicious Access to Cryptocurrency Wallet Files

[rule]
description = """
Identifies access attempts to multiple unique cryptocurrency wallet files by the same process. Adversaries may steal
those files to for financial gains.
"""
id = "c4c69f61-db49-4e05-adea-82122e889044"
license = "Elastic License v2"
name = "Suspicious Access to Cryptocurrency Wallet Files"
os_list = ["windows"]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=30s
[file where event.type == "access" and process.pid != 4 and
   file.path :
      ("*\\ElectronCash\\wallets*",
       "*\\Electrum-LTC\\wallets*",
       "*\\Electrum\\wallets*",
       "*\\Ethereum\\keystore*",
       "*\\Exodus\\exodus.wallet*",
       "*\\Bitcoin\\wallets*",
       "*\\Coinomi\\wallets*",
       "*\\Appdata\\Roaming\\Raven\\*wallet*",
       "*\\DaedalusMainnet\\wallets*",
       "*\\Blockstream\\Green\\wallets*",
       "*\\MultiDoge\\multidoge.wallet*",
       "*\\WalletWasabi\\Client\\Wallets*",
       "*\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
       "*\\Appdata\\Roaming\\atomic\\LocalStorage\\leveldb*",
       "*AppData\\Roaming\\Guarda\\LocalStorage\\leveldb*",
       "*fhbohimaelbohpjbbldcngcnapndodjp*",
       "*aeachknmefphepccionboohckonoeemg*",
       "*hnfanknocfeofbddgcijnmhnfnkdnaad*",
       "*hifafgmccdpekplomjjkcfgodnhcellj*",
       "*nkbihfbeogaeaoehlefnkodbefgpgknn*",
       "*ejbalbakoplchlghecdalmeeeajnimhm*",
       "*bfnaelmomeimhlpmgjnjophhpkkoljpa*",
       "*fnjhmkhhmkbjkkabndcnnogagogbneec*",
       "ibnejdfjmmkpcnlpebklmnkoeoihofec*",
       "*klfhbdnlcfcaccoakhceodhldjojboga*",
       "*aanjhgiamnacdfnlfnmgehjikagdbafd*",
       "*bblmcdckkhkhfhhpfcchlpalebmonecp*",
       "*hpglfhgfnhbgpjdenjgmdgoeiappafln*",
       "*afbcbjpbpfadlkmhmclhkeeodmamcflc*",
       "*kncchdigobghenbbaddojjnnaogfppfj*") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe", "?:\\Windows\\explorer.exe") and
    not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
    not (process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" and
         process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true) and
    not (process.code_signature.subject_name in ("Exodus Movement Inc", "Exodus Movement, Inc.") and process.code_signature.trusted == true and
         file.path : "?:\\Users\\*\\Exodus\\exodus.wallet*")
    ] as event0
[file where event.type == "access" and process.pid != 4 and
   file.path :
      ("*\\ElectronCash\\wallets*",
       "*\\Electrum-LTC\\wallets*",
       "*\\Electrum\\wallets*",
       "*\\Ethereum\\keystore*",
       "*\\Exodus\\exodus.wallet*",
       "*\\Bitcoin\\wallets*",
       "*\\Coinomi\\wallets*",
       "*\\Appdata\\Roaming\\Raven\\*wallet*",
       "*\\DaedalusMainnet\\wallets*",
       "*\\Blockstream\\Green\\wallets*",
       "*\\MultiDoge\\multidoge.wallet*",
       "*\\WalletWasabi\\Client\\Wallets*",
       "*\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
       "*\\Appdata\\Roaming\\atomic\\LocalStorage\\leveldb*",
       "*AppData\\Roaming\\Guarda\\LocalStorage\\leveldb*",
       "*fhbohimaelbohpjbbldcngcnapndodjp*",
       "*aeachknmefphepccionboohckonoeemg*",
       "*hnfanknocfeofbddgcijnmhnfnkdnaad*",
       "*hifafgmccdpekplomjjkcfgodnhcellj*",
       "*nkbihfbeogaeaoehlefnkodbefgpgknn*",
       "*ejbalbakoplchlghecdalmeeeajnimhm*",
       "*bfnaelmomeimhlpmgjnjophhpkkoljpa*",
       "*fnjhmkhhmkbjkkabndcnnogagogbneec*",
       "ibnejdfjmmkpcnlpebklmnkoeoihofec*",
       "*klfhbdnlcfcaccoakhceodhldjojboga*",
       "*aanjhgiamnacdfnlfnmgehjikagdbafd*",
       "*bblmcdckkhkhfhhpfcchlpalebmonecp*",
       "*hpglfhgfnhbgpjdenjgmdgoeiappafln*",
       "*afbcbjpbpfadlkmhmclhkeeodmamcflc*",
       "*kncchdigobghenbbaddojjnnaogfppfj*") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
    not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and file.name != event0.file.name]
'''

min_endpoint_version = "8.6.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[threat.technique.subtechnique]]
id = "T1552.001"
name = "Credentials In Files"
reference = "https://attack.mitre.org/techniques/T1552/001/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.6.0"