Suspicious Access to Web Browser Credential Stores

[rule]
description = """
Identifies access to more than one web browser's credential store data by the same process. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "03758167-3eed-465f-9174-b284d599036d"
license = "Elastic License v2"
name = "Suspicious Access to Web Browser Credential Stores"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/globally-distributed-stealers"]
version = "1.0.37"

query = '''
sequence by process.entity_id with maxspan=1m
  [file where event.action == "open" and process.executable != null and
    user.id : ("S-1-5-21*", "S-1-12-*") and not process.pid == 4 and process.code_signature.trusted != true and
    file.path :
       (  /* chromium based browsers (chrome, edge, brave etc.) */
        "?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Login Data",

         /* some infostealers access only the cookies file and don't touch pwd file logins.json */
        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\logins.json",
        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite") and
	 not process.executable :
	           ("?:\\Program Files\\*.exe",
			    "?:\\Program Files (x86)\\*.exe",
				"?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
				"?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
				"*\\Program Files*\\Windows Defender\\MsMpEng.exe" ,
				"\\Device\\Mup\\*\\firefox.exe")] as event0
   [file where event.action == "open" and process.executable != null and
    file.path :
       ("?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Login Data",
        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\logins.json",
        "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*default*\\cookies.sqlite") and
    not startswith~(file.path, event0.file.path)]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.4.0"