Windows: Monitor File Access to Signal Desktop config.json and db.sqlite

Alerts on unauthorized access attempts to Signal Desktop’s config.json (key) and db.sqlite (messages) in the default Roaming path.

FreeUnreviewedSigmamediumv1

windows-monitor-file-access-to-signal-desktop-config-json-and-db-sqlite-5d6c375a

title: "Windows: Monitor File Access to Signal Desktop config.json and db.sqlite"
id: 4c686b1a-3426-4030-83ad-3c4896cb0450
status: experimental
description: This rule flags Windows Security event 4663 when files within the default Signal Desktop profile directory are accessed, specifically config.json and db.sqlite. These files matter because config.json holds the decryption key in plain text and db.sqlite contains locally stored messages, so access to both can enable decryption and recovery of sensitive content. The detection relies on file-object access telemetry (event 4663) including the accessed object path and enforces exclusion for Signal’s portable and standard executables to reduce noise from expected app activity.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/
  - https://vmois.dev/query-signal-desktop-messages-sqlite/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_signal_sensitive_config_access.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1003
logsource:
  product: windows
  service: security
  definition: "Requirements: System Access Control List (SACL) policy with attributes List folder/read data on Objects"
detection:
  selection:
    EventID: 4663
    ObjectType: File
    ObjectName|contains: \AppData\Roaming\Signal\
    ObjectName|endswith:
      - \config.json
      - \db.sqlite
  filter_main_signal:
    ProcessName|endswith:
      - \signal-portable.exe
      - \signal.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely, but possible from AV or backup software accessing the files.
level: medium
license: DRL-1.1
related:
  - id: 5d6c375a-18ae-4952-b4f6-8b803f6c8555
    type: derived

What it detects

This rule flags Windows Security event 4663 when files within the default Signal Desktop profile directory are accessed, specifically config.json and db.sqlite. These files matter because config.json holds the decryption key in plain text and db.sqlite contains locally stored messages, so access to both can enable decryption and recovery of sensitive content. The detection relies on file-object access telemetry (event 4663) including the accessed object path and enforces exclusion for Signal’s portable and standard executables to reduce noise from expected app activity.

Known false positives

Unlikely, but possible from AV or backup software accessing the files.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.