Windows process execution of where.exe with browser bookmark database or history artifacts

title: Windows process execution of where.exe with browser bookmark database or history artifacts
id: 2213b9d7-7c00-4377-82fb-23a553a17e17
status: test
description: This rule flags Windows process creation events where.exe is executed and the command line contains strings associated with browser data sources such as Firefox places.sqlite/cookies.sqlite/formhistory.sqlite/logins.json/key3.db/key4.db/sessionstore.jsonlz4 or Chrome History/Bookmarks/Cookies/Login Data. Attackers may use where.exe-like enumeration to locate or validate the presence of user or internal web artifacts that can aid discovery and follow-on access. The detection relies on process creation telemetry and string matches in the executed command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_where_browser_data_recon.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-12-13
modified: 2022-06-29
tags:
  - attack.discovery
  - attack.t1217
logsource:
  category: process_creation
  product: windows
detection:
  where_exe:
    - Image|endswith: \where.exe
    - OriginalFileName: where.exe
  where_opt:
    CommandLine|contains:
      - places.sqlite
      - cookies.sqlite
      - formhistory.sqlite
      - logins.json
      - key4.db
      - key3.db
      - sessionstore.jsonlz4
      - History
      - Bookmarks
      - Cookies
      - Login Data
  condition: all of where_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a
    type: derived