Windows Process Creation: SQLite Access to Firefox Profile Databases
Alerts when Windows runs SQLite tooling to query Firefox profile DBs like cookies.sqlite or places.sqlite.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-04-08
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows processes running the SQLite client binaries (sqlite.exe or sqlite3.exe) with command lines indicating access to Firefox (or other Gecko-based) profile databases such as cookies.sqlite and places.sqlite. Attackers can use SQLite to query local browser data for credential or session theft and broader collection of browsing history/bookmarks. It relies on process creation telemetry, matching the executable name and specific database filenames in the command line.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows
- blog.cyble.comhttps://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: SQLite Access to Firefox Profile Databases"
id: a83d6ace-4011-49cf-9dfc-98af8446dded
status: test
description: This rule flags Windows processes running the SQLite client binaries (sqlite.exe or sqlite3.exe) with command lines indicating access to Firefox (or other Gecko-based) profile databases such as cookies.sqlite and places.sqlite. Attackers can use SQLite to query local browser data for credential or session theft and broader collection of browsing history/bookmarks. It relies on process creation telemetry, matching the executable name and specific database filenames in the command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows
- https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml
author: frack113, Huntrule Team
date: 2022-04-08
modified: 2023-01-19
tags:
- attack.credential-access
- attack.t1539
- attack.collection
- attack.t1005
logsource:
category: process_creation
product: windows
detection:
selection_sql:
- Product: SQLite
- Image|endswith:
- \sqlite.exe
- \sqlite3.exe
selection_firefox:
CommandLine|contains:
- cookies.sqlite
- places.sqlite
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4833155a-4053-4c9c-a997-777fcea0baa7
type: derived