Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\Roaming

Alerts on unauthorized access attempts to Signal Desktop’s config.json (key) and db.sqlite (messages) in the default Roaming path.

FreeReviewedSigma · Medium · v2

Product: windows
Service: security
Author: Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
Published: 2025-10-19
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003OS Credential Dumping
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows Security event 4663 for file access to Signal Desktop’s sensitive data files, specifically db.sqlite and config.json, under the default AppData\Roaming\Signal path. It matters because config.json contains the decryption key in plaintext, and db.sqlite stores locally saved messages, so access to both files can allow an attacker to decrypt message contents without the user’s credentials. The detection relies on audited file-system access events that include the accessed object name/type and are filtered to exclude accesses made by the Signal-related executables.

Reporting behind it

Related detections9 linkedT1003 — drag to rearrange

Malicious Wdigest Authentication Enabled - Reg via Command (via process_creation)

Malicious Diskshadow Command Abuse to Expose VSS Backup (via process_creation)

Malicious IIS Application Pool Credential Dumping (via process_creation)

Malicious Wdigest Authentication Enabled - Registry (via registry_set)

Suspicious Veeam Backup Credential Harvesting via PowerShell (via ps_script)

Suspicious Network Provider Registration for Credential Interception via NPPSpy

Malicious Mimikatz Malicious Security Package (SSP) Exfiltrates Cleartext Passwords in File (via file_event)

Malicious WDigest UseLogonCredential Enablement For Credential Theft

Linux: Detect changes to fs.suid_dumpable enabling core dumps for SUID processes

Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\Roaming

Pivot detection · T1003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-monitor-file-access-to-signal-desktop-config-json-and-db-sqlite-5d6c375a

title: "Windows: Monitor access to Signal Desktop config.json and db.sqlite in AppData\\Roaming"
id: 4c686b1a-3426-4030-83ad-3c4896cb0450
status: experimental
description: This rule flags Windows Security event 4663 for file access to Signal Desktop’s sensitive data files, specifically db.sqlite and config.json, under the default AppData\Roaming\Signal path. It matters because config.json contains the decryption key in plaintext, and db.sqlite stores locally saved messages, so access to both files can allow an attacker to decrypt message contents without the user’s credentials. The detection relies on audited file-system access events that include the accessed object name/type and are filtered to exclude accesses made by the Signal-related executables.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/
  - https://vmois.dev/query-signal-desktop-messages-sqlite/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_signal_sensitive_config_access.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1003
logsource:
  product: windows
  service: security
  definition: "Requirements: System Access Control List (SACL) policy with attributes List folder/read data on Objects"
detection:
  selection:
    EventID: 4663
    ObjectType: File
    ObjectName|contains: \AppData\Roaming\Signal\
    ObjectName|endswith:
      - \config.json
      - \db.sqlite
  filter_main_signal:
    ProcessName|endswith:
      - \signal-portable.exe
      - \signal.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely, but possible from AV or backup software accessing the files.
level: medium
license: DRL-1.1
related:
  - id: 5d6c375a-18ae-4952-b4f6-8b803f6c8555
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL