Web Browser Credential Data Accessed by Osascript

[rule]
description = """
Detects when Osascript is seen accessing sensitive web browser files. Adversaries may steal credentials from web
browsers by reading files specific to the target browser.
"""
id = "9885462e-e551-4d61-91ad-1e76ec67a040"
license = "Elastic License v2"
name = "Web Browser Credential Data Accessed by Osascript"
os_list = ["macos"]
version = "1.0.6"

query = '''
file where event.action == "open" and process.name == "osascript" and 
 file.name like~ ("cookies.sqlite", 
                  "key?.db", 
                  "logins.json", 
                  "Cookies", 
                  "Cookies.binarycookies", 
                  "Login Data")
'''

min_endpoint_version = "8.10.2"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.003"
name = "Credentials from Web Browsers"
reference = "https://attack.mitre.org/techniques/T1555/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.2"