Windows: Detect esentutl.exe usage to collect browser cache data

title: "Windows: Detect esentutl.exe usage to collect browser cache data"
id: de5604a4-30b5-426d-9d08-ccb153463232
status: test
description: This rule identifies process executions of esentutl.exe where the command line includes the -r flag and references the Windows WebCache path. Adversaries can use esentutl.exe to access and extract information stored in browser-related caching databases, which may contain sensitive data. The detection relies on Windows process creation telemetry fields such as Image/OriginalFileName and CommandLine contents.
references:
  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
  - https://redcanary.com/threat-detection-report/threats/qbot/
  - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2024-03-05
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \esentutl.exe
    - OriginalFileName: esentutl.exe
  selection_flag:
    CommandLine|contains|windash: -r
  selection_webcache:
    CommandLine|contains: \Windows\WebCache
  condition: all of selection*
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: 6a69f62d-ce75-4b57-8dce-6351eb55b362
    type: derived