Detection rules › Splunk
Browser Credential File Accessed - Windows (Windows Event Log)
Threat actors may attempt to access stored credentials from files stored web browsers installed on a host. This use case detects when files containing browser credentials are accessed from a process outside of the standard Windows system paths.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1003 OS Credential Dumping, T1555.003 Credentials from Password Stores: Credentials from Web Browsers |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4656 | A handle to an object was requested. |
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
Rule body yaml
id: '27651.50275'
title: Browser Credential File Accessed - Windows
description: 'Threat actors may attempt to access stored credentials from files stored
web browsers installed on a host. This use case detects when files containing browser
credentials are accessed from a process outside of the standard Windows system paths. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
"<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat"
OR "\\cookies.sqlite" OR "release\\key3.db" OR "release\\key4.db" OR "release\\logins.json"
OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" OR "\\Appdata\\Local\\Chrome\\User
Data\\Default\\Login Data" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Local
State" | regex parent_process_name!="(?i)msiexec\.exe|^idle$"| regex user!="\$$"|
regex process_path!="(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c|C:\x5cProgram\sFiles(\s\(x86\))?\x5c|C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c"|
table _time, host, user, process_name, parent_process_name, ObjectName | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- credential-access:credentials from password stores:credentials from web browsers
- credential-access:os credential dumping
technique_id:
- T1555.003
- T1003
data_category:
- Windows event logs
references:
- https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/file/file_access/file_access_win_browser_credential_stealing.yml
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR "<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" OR "\\cookies.sqlite" OR "release\\key3.db" OR "release\\key4.db" OR "release\\logins.json" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" OR "\\Appdata\\Local\\Chrome\\User Data\\Default\\Login Data" OR "\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
Stage 2: regex
| regex parent_process_name!="(?i)msiexec\.exe|^idle$"
Stage 3: regex
| regex user!="\$$"
Stage 4: regex
| regex process_path!="(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c|C:\x5cProgram\sFiles(\s\(x86\))?\x5c|C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c"
Stage 5: table
| table _time, host, user, process_name, parent_process_name, ObjectName
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
parent_process_name | regex_match | "(?i)msiexec.exe, ^idle$" |
user | regex_match | "$$" |
process_path | regex_match | "(?i)^C:\x5cWindows\x5c(system32|syswow64)\x5c, C:\x5cProgram\sFiles(\s(x86))?\x5c, C:\x5cProgramData\x5cMicrosoft\x5cWindows\xDefender\x5c" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4656<" |
| 1 | TERM |
| 1 | "<EventID>4663<" |
| 1 | "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" |
| 1 | "\\cookies.sqlite" |
| 1 | "release\\key3.db" |
| 1 | "release\\key4.db" |
| 1 | "release\\logins.json" |
| 1 | "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" |
| 1 | "\\Appdata\\Local\\Chrome\\User Data\\Default\\Login Data" |
| 1 | "\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" |