Web Browser Credential Access via Unsigned Process

[rule]
description = """
Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal
credentials from web browsers by reading files specific to the target browser.
"""
id = "9ed4ee4a-bc91-4d38-b6dd-11467b774460"
license = "Elastic License v2"
name = "Web Browser Credential Access via Unsigned Process"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/detect-credential-access",
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
]
version = "1.0.39"

query = '''
sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and process.hash.sha256 != null and
   (
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or

    (process.Ext.relative_file_creation_time <= 500 and
     (process.code_signature.trusted == false or process.code_signature.exists == false) and
     not process.code_signature.status : "errorCode_endpoint*" and
     not (process.code_signature.subject_name == "Rapid7 LLC" and process.code_signature.status == "errorBadDigest"))
    ) and
    not (process.code_signature.subject_name == "Guardicore Ltd" and process.code_signature.status == "errorExpired") and
    not process.hash.sha256 : ("589c5f680eefb085a3c67c8115febbfb134dcd61e43acda83d8a2cc9c4eee035",
                               "67435999749d9e6908a4029321c0c6f9e915135e98e01a7e499a1c55a960bc68",
                               "2ef4b2d23912e15a1b0a47e17e249a909df5d973381c93741a6adbf119182e3d",
                               "6d167aee7013d61b0832937773cd71d77493a05d6ffb1849bdfb1477622e54c2",
                               "8ab494be664d7bb9a7e0dda2bc4fc6592ab26f6bb5d44b6b71b80297a532a517",
                               "eeae738673b6d694c0669fb8cd4c498b7ec6af2239d0ce3e2e6370fe75c2a771",
                               "1ea6c21fb667401513fc8c2106523510f77647a271be4f9cc1abc5b06d0e3eb5",
                               "5094013ae4283c70eeea7e2b1b4f2c084439ea8cc538473273586cf80dd79caf",
                               "84618d4ac2894c5febaf545f24285fe75cd8b4e166d5bde923661ca0d0fb7c4c")
    ]
  [file where event.type == "access" and
    /* domain user RID */
    user.id : ("S-1-5-21*", "S-1-12-*") and
    not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
    (
     file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or 
     file.path : 
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State", 
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", 
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
     ) 
     and not (process.name : "certutil.exe" and file.name : ("key?.db", "cert?.db"))
    ]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.4.0"