User browser credentials dump via network share (DonPapi, Lazagne)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.

Known false positives

Roaming user profile, vulnerability scanners

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555.003` Credentials from Password Stores: Credentials from Web Browsers

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: User browser credentials dump via network share (DonPapi, Lazagne)
description: Detects scenarios where an attacker attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1555-Credentials%20from%20Password%20Stores
- https://github.com/login-securite/DonPAPI
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
tags:
- attack.credential_access
- attack.t1555.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 5145
    ShareName: '\\*\C$'
  selection_browsers_credentials:
    - RelativeTargetName|endswith:
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
      - '\AppData\Local\Temp\edge-cookies.json'
    - RelativeTargetName|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Login Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\Default\Cookies\'
  condition: selection_event and selection_browsers_credentials
falsepositives:
- Roaming user profile, vulnerability scanners
level: high

Stages and Predicates

Stage 0: `condition`

selection_event and selection_browsers_credentials

Stage 1: `selection_event`

selection_event:
  EventID: 5145
  ShareName: '\\*\C$'

Stage 2: `selection_browsers_credentials`

selection_browsers_credentials:
  - RelativeTargetName|endswith:
    - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    - '\AppData\Local\Temp\edge-cookies.json'
  - RelativeTargetName|contains:
    - '\AppData\Local\Google\Chrome\User Data\'
    - '\AppData\Local\Microsoft\Edge\User Data\Default\Login Data\'
    - '\AppData\Local\Microsoft\Edge\User Data\Default\Cookies\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RelativeTargetName`	ends_with	`\AppData\Local\Temp\edge-cookies.json` `\AppData\Roaming\Mozilla\Firefox\Profiles\`	`field:"RelativeTargetName" kind:ends_with`
`RelativeTargetName`	match	`\AppData\Local\Google\Chrome\User Data\` `\AppData\Local\Microsoft\Edge\User Data\Default\Cookies\` `\AppData\Local\Microsoft\Edge\User Data\Default\Login Data\`	`field:"RelativeTargetName" kind:match`
`ShareName`	wildcard	`\\*\C$` corpus 7 (sigma 7)	`field:"ShareName" kind:wildcard value:"\\*\C$"`

User browser credentials dump via network share (DonPapi, Lazagne)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_event

Stage 2: selection_browsers_credentials

Indicators

Stage 0: `condition`

Stage 1: `selection_event`

Stage 2: `selection_browsers_credentials`