Access To Crypto Currency Wallets By Uncommon Applications

Status: test
Severity: medium
Log source: category file_access, product windows
Author: X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

Known false positives

Antivirus, Anti-Spyware, Anti-Malware Software
Backup software
Legitimate software installed on partitions other than "C:\"
Searching software such as "everything.exe"

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Rule body

title: Access To Crypto Currency Wallets By Uncommon Applications
id: f41b0311-44f9-44f0-816d-dd45e39d4bc8
status: test
description: |
    Detects file access requests to crypto currency files by uncommon processes.
    Could indicate potential attempt of crypto currency wallet stealing.
references:
    - Internal Research
author: X__Junior (Nextron Systems)
date: 2024-07-29
tags:
    - attack.t1003
    - attack.credential-access
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        - FileName|contains:
              - '\AppData\Roaming\Ethereum\keystore\'
              - '\AppData\Roaming\EthereumClassic\keystore\'
              - '\AppData\Roaming\monero\wallets\'
        - FileName|endswith:
              - '\AppData\Roaming\Bitcoin\wallet.dat'
              - '\AppData\Roaming\BitcoinABC\wallet.dat'
              - '\AppData\Roaming\BitcoinSV\wallet.dat'
              - '\AppData\Roaming\DashCore\wallet.dat'
              - '\AppData\Roaming\DogeCoin\wallet.dat'
              - '\AppData\Roaming\Litecoin\wallet.dat'
              - '\AppData\Roaming\Ripple\wallet.dat'
              - '\AppData\Roaming\Zcash\wallet.dat'
    filter_main_system:
        Image: System
    filter_main_generic:
        # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_defender:
        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
        Image|endswith:
            - '\MpCopyAccelerator.exe'
            - '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Antivirus, Anti-Spyware, Anti-Malware Software
    - Backup software
    - Legitimate software installed on partitions other than "C:\"
    - Searching software such as "everything.exe"
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    - FileName|contains:
          - '\AppData\Roaming\Ethereum\keystore\'
          - '\AppData\Roaming\EthereumClassic\keystore\'
          - '\AppData\Roaming\monero\wallets\'
    - FileName|endswith:
          - '\AppData\Roaming\Bitcoin\wallet.dat'
          - '\AppData\Roaming\BitcoinABC\wallet.dat'
          - '\AppData\Roaming\BitcoinSV\wallet.dat'
          - '\AppData\Roaming\DashCore\wallet.dat'
          - '\AppData\Roaming\DogeCoin\wallet.dat'
          - '\AppData\Roaming\Litecoin\wallet.dat'
          - '\AppData\Roaming\Ripple\wallet.dat'
          - '\AppData\Roaming\Zcash\wallet.dat'

Stage 2: `not filter_main_*`

filter_main_system:
    Image: System
filter_main_generic:
    Image|startswith:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\system32\'
        - 'C:\Windows\SysWOW64\'

Stage 3: `not filter_optional_defender`

filter_optional_defender:
    Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
    Image|endswith:
        - '\MpCopyAccelerator.exe'
        - '\MsMpEng.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`System`	`excludes:Image` `field:"Image" value:"System"`
`Image`	starts_with	`C:\Program Files (x86)\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\"`
`Image`	starts_with	`C:\Program Files\`	`excludes:Image` `field:"Image" value:"C:\Program Files\"`
`Image`	starts_with	`C:\Windows\SysWOW64\`	`excludes:Image` `field:"Image" value:"C:\Windows\SysWOW64\"`
`Image`	starts_with	`C:\Windows\system32\`	`excludes:Image` `field:"Image" value:"C:\Windows\system32\"`
`Image`	ends_with	`\MpCopyAccelerator.exe`	`excludes:Image` `field:"Image" value:"\MpCopyAccelerator.exe"`
`Image`	ends_with	`\MsMpEng.exe`	`excludes:Image` `field:"Image" value:"\MsMpEng.exe"`
`Image`	starts_with	`C:\ProgramData\Microsoft\Windows Defender\`	`excludes:Image` `field:"Image" value:"C:\ProgramData\Microsoft\Windows Defender\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`FileName`	ends_with	`\AppData\Roaming\BitcoinABC\wallet.dat` `\AppData\Roaming\BitcoinSV\wallet.dat` `\AppData\Roaming\Bitcoin\wallet.dat` `\AppData\Roaming\DashCore\wallet.dat` `\AppData\Roaming\DogeCoin\wallet.dat` `\AppData\Roaming\Litecoin\wallet.dat` `\AppData\Roaming\Ripple\wallet.dat` `\AppData\Roaming\Zcash\wallet.dat`	`field:"file_name" kind:ends_with`
`FileName`	match	`\AppData\Roaming\EthereumClassic\keystore\` `\AppData\Roaming\Ethereum\keystore\` `\AppData\Roaming\monero\wallets\`	`field:"file_name" kind:match`