huntrule

Windows File Access to Browser Credential Stores by Uncommon Processes

Detects suspicious process access to Firefox/Chromium credential store files on Windows, excluding common system and known benign paths.

FreeUnreviewedSigmalowv1
title: Windows File Access to Browser Credential Stores by Uncommon Processes
id: 4544308a-58d3-4224-8a39-98f29bbb1cab
related:
  - id: 4b60e527-ec73-4b47-8cb3-f02ad927ca65
    type: similar
  - id: 91cb43db-302a-47e3-b3c8-7ede481e27bf
    type: derived
status: test
description: This rule flags Windows file access events where the FileName matches common browser credential store locations (Chromium login data/local state, Firefox cookies/places/key and related files, and the WebCacheV01.dat cache file). Access from processes other than the excluded common system and standard program paths can indicate attempts to read cached credentials or session data. It relies on Microsoft-Windows-Kernel-File ETW telemetry containing the accessed FileName and the accessing process Image, with exclusions to reduce noise. Baseline the event volume and typical accessing applications before use to avoid false positives from legitimate security and backup tools.
references:
  - https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users
  - https://github.com/lclevy/firepwd
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_access/file_access_win_browsers_credential.yml
author: frack113, X__Junior (Nextron Systems), Huntrule Team
date: 2022-04-09
modified: 2024-07-29
tags:
  - attack.t1003
  - attack.credential-access
  - detection.threat-hunting
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection_ie:
    FileName|endswith: \Appdata\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
  selection_firefox:
    FileName|endswith:
      - \cookies.sqlite
      - \places.sqlite
      - release\key3.db
      - release\key4.db
      - release\logins.json
  selection_chromium:
    FileName|contains:
      - \User Data\Default\Login Data
      - \User Data\Local State
  filter_main_system:
    Image: System
  filter_main_generic:
    Image|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    Image|startswith: C:\ProgramData\Microsoft\Windows Defender\
    Image|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  filter_optional_thor:
    Image|endswith:
      - \thor.exe
      - \thor64.exe
  condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Antivirus, Anti-Spyware, Anti-Malware Software
  - Backup software
  - Legitimate software installed on partitions other than "C:\"
  - Searching software such as "everything.exe"
level: low
license: DRL-1.1

What it detects

This rule flags Windows file access events where the FileName matches common browser credential store locations (Chromium login data/local state, Firefox cookies/places/key and related files, and the WebCacheV01.dat cache file). Access from processes other than the excluded common system and standard program paths can indicate attempts to read cached credentials or session data. It relies on Microsoft-Windows-Kernel-File ETW telemetry containing the accessed FileName and the accessing process Image, with exclusions to reduce noise. Baseline the event volume and typical accessing applications before use to avoid false positives from legitimate security and backup tools.

Known false positives

  • Antivirus, Anti-Spyware, Anti-Malware Software
  • Backup software
  • Legitimate software installed on partitions other than "C:\"
  • Searching software such as "everything.exe"

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.