Windows Process Creation: SQLite Access to Firefox Profile Databases

title: "Windows Process Creation: SQLite Access to Firefox Profile Databases"
id: a83d6ace-4011-49cf-9dfc-98af8446dded
status: test
description: This rule flags Windows processes running the SQLite client binaries (sqlite.exe or sqlite3.exe) with command lines indicating access to Firefox (or other Gecko-based) profile databases such as cookies.sqlite and places.sqlite. Attackers can use SQLite to query local browser data for credential or session theft and broader collection of browsing history/bookmarks. It relies on process creation telemetry, matching the executable name and specific database filenames in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows
  - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml
author: frack113, Huntrule Team
date: 2022-04-08
modified: 2023-01-19
tags:
  - attack.credential-access
  - attack.t1539
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_sql:
    - Product: SQLite
    - Image|endswith:
        - \sqlite.exe
        - \sqlite3.exe
  selection_firefox:
    CommandLine|contains:
      - cookies.sqlite
      - places.sqlite
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4833155a-4053-4c9c-a997-777fcea0baa7
    type: derived