Web Browser Credential Access via Scripting Utility

[rule]
description = """
Identifies an unexpected process accessing the password store of commonly used web browsers. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "215d1262-984e-4ffc-8e26-f568ed77b3cb"
license = "Elastic License v2"
name = "Web Browser Credential Access via Scripting Utility"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
    "https://www.elastic.co/security-labs/detect-credential-access",
]
version = "1.0.2"

query = '''
sequence by process.entity_id with maxspan=5m
[process where event.action == "start" and 
 (
  process.name : ("node.exe", "python*.exe", "wscript.exe", "mshta.exe",  "AutoIt*.exe") or
  process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "The MathWorks, Inc.", "Python Software Foundation")
 ) and
 not (process.name : "wscript.exe" and process.args : "\\\\*\\*") and 
 not process.executable : 
             ("?:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\python.exe", 
              "?:\\Program Files\\Common Files\\Adobe\\Creative Cloud Libraries\\libs\\node.exe", 
              "?:\\Program Files (x86)\\Adobe\\Adobe Creative Cloud Experience\\libs\\node.exe", 
              "?:\\Program Files\\Adobe\\Adobe Creative Cloud Experience\\libs\\node.exe",
              "?:\\Program Files\\Qlik\\Sense\\ServiceDispatcher\\Node\\node.exe", 
              "?:\\Program Files\\MATLAB\\*\\bin\\win64\\MATLAB.exe")]
[file where event.type == "access" and
  file.path :
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State",
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")]
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"