Windows File Access to Crypto Wallet Files by Uncommon Applications

title: Windows File Access to Crypto Wallet Files by Uncommon Applications
id: 70a05b97-910d-458f-9092-5b6880e27d7a
status: test
description: This rule flags file access attempts to common cryptocurrency wallet locations and filenames, such as Ethereum/ETC keystores and Bitcoin-style wallet.dat files. Access by an uncommon process may indicate wallet credential theft or unauthorized harvesting of sensitive wallet data. It relies on Windows kernel file access telemetry, including the accessed FileName and the accessing process Image, with filters to suppress expected system and common security/installation paths.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2024-07-29
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    - FileName|contains:
        - \AppData\Roaming\Ethereum\keystore\
        - \AppData\Roaming\EthereumClassic\keystore\
        - \AppData\Roaming\monero\wallets\
    - FileName|endswith:
        - \AppData\Roaming\Bitcoin\wallet.dat
        - \AppData\Roaming\BitcoinABC\wallet.dat
        - \AppData\Roaming\BitcoinSV\wallet.dat
        - \AppData\Roaming\DashCore\wallet.dat
        - \AppData\Roaming\DogeCoin\wallet.dat
        - \AppData\Roaming\Litecoin\wallet.dat
        - \AppData\Roaming\Ripple\wallet.dat
        - \AppData\Roaming\Zcash\wallet.dat
  filter_main_system:
    Image: System
  filter_main_generic:
    Image|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    Image|startswith: C:\ProgramData\Microsoft\Windows Defender\
    Image|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Antivirus, Anti-Spyware, Anti-Malware Software
  - Backup software
  - Legitimate software installed on partitions other than "C:\"
  - Searching software such as "everything.exe"
level: medium
license: DRL-1.1
related:
  - id: f41b0311-44f9-44f0-816d-dd45e39d4bc8
    type: derived