User application credentials dump via network share (DonPapi, Lazagne)

title: User application credentials dump via network share (DonPapi, Lazagne)
description: Detects scenarios where an attacker attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1555-Credentials%20from%20Password%20Stores
- https://github.com/login-securite/DonPAPI
tags:
- attack.credential_access
- attack.t1555
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_event:
    EventID: 5145
    ShareName: '\\*\C$'

  selection_VNC:
    RelativeTargetName:
      - 'Program Files (x86)\UltraVNC\ultravnc.ini'
      - 'Program Files (x86)\uvnc bvba\UltraVNC\ultravnc.ini'
      - 'ProgramFiles(x86)\UltraVNC\ultravnc.ini'
      - 'ProgramFiles(x86)\uvnc bvba\UltraVNC\ultravnc.ini'
      - 'PROGRAMFILES\UltraVNC\ultravnc.ini'
      - 'PROGRAMFILES\uvnc bvba\UltraVNC\ultravnc.ini'
      - 'PROGRAM FILES\UltraVNC\ultravnc.ini'
      - 'PROGRAM FILES\uvnc bvba\UltraVNC\ultravnc.ini'

  selection_application_credentials:
    - RelativeTargetName|endswith:
      - '\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini'
      - '\AppData\Roaming\Comodo\IceDragon\profiles.ini'
      - '\AppData\Roaming\K-Meleon\profiles.ini'
      - '\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini'
    - RelativeTargetName|contains:
      - '\AppData\Local\mRemoteNG\'
      - '\AppData\Roaming\mRemoteNG\'

  condition: selection_event and (selection_VNC OR selection_application_credentials)
falsepositives:
- Roaming user profile, vulnerability scanners
level: high