Detection rules › Splunk
Browser Credential File Accessed - Windows (Windows Event Log)
Threat actors may attempt to access stored credentials from files stored web browsers installed on a host. This use case detects when files containing browser credentials are accessed from a process outside of the standard Windows system paths.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
Rule body
id: '27651.50275'
title: Browser Credential File Accessed - Windows
description: 'Threat actors may attempt to access stored credentials from files stored
web browsers installed on a host. This use case detects when files containing browser
credentials are accessed from a process outside of the standard Windows system paths. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
"<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat"
OR "\\cookies.sqlite" OR "release\\key3.db" OR "release\\key4.db" OR "release\\logins.json"
OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" OR "\\Appdata\\Local\\Chrome\\User
Data\\Default\\Login Data" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Local
State" | regex parent_process_name!="(?i)msiexec\.exe|^idle$"| regex user!="\$$"|
regex process_path!="(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c|C:\x5cProgram\sFiles(\s\(x86\))?\x5c|C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c"|
table _time, host, user, process_name, parent_process_name, ObjectName | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- credential-access:credentials from password stores:credentials from web browsers
- credential-access:os credential dumping
technique_id:
- T1555.003
- T1003
data_category:
- Windows event logs
references:
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_access/file_access_win_browser_credential_stealing.yml
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR "<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" OR "\\cookies.sqlite" OR "release\\key3.db" OR "release\\key4.db" OR "release\\logins.json" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" OR "\\Appdata\\Local\\Chrome\\User Data\\Default\\Login Data" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
Stage 2: regex
| regex parent_process_name!="(?i)msiexec\.exe|^idle$"
Stage 3: regex
| regex user!="\$$"
Stage 4: regex
| regex process_path!="(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c|C:\x5cProgram\sFiles(\s\(x86\))?\x5c|C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c"
Stage 5: table
| table _time, host, user, process_name, parent_process_name, ObjectName
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
parent_process_name | regex_match | "(?i)msiexec.exe, ^idle$" | excludes:parent_process_name |
user | regex_match | "$$" | excludes:user |
process_path | regex_match | "(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c, C:\x5cProgram\sFiles(\s(x86))?\x5c, C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c" | excludes:process_path |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4656<" |
| 1 | "<EventID>4663<" |
| 1 | "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" |
| 1 | "\\cookies.sqlite" |
| 1 | "release\\key3.db" |
| 1 | "release\\key4.db" |
| 1 | "release\\logins.json" |
| 1 | "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" |
| 1 | "\\Appdata\\Local\\Chrome\\User Data\\Default\\Login Data" |
| 1 | "\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" |