Windows Security: Access to Browser Credential Files by Uncommon Processes

title: "Windows Security: Access to Browser Credential Files by Uncommon Processes"
id: d84381b0-eb29-4074-8cda-093e1788433e
related:
  - id: 91cb43db-302a-47e3-b3c8-7ede481e27bf
    type: similar
  - id: 4b60e527-ec73-4b47-8cb3-f02ad927ca65
    type: derived
status: test
description: This rule flags Windows Security Event ID 4663 file access attempts targeting common browser credential and session stores, such as Chromium “Login Data” and “Local State” and Firefox cookie/history/key databases. Such access by an unusual or non-whitelisted process can indicate attempts to read or steal browser-stored credentials. Detection relies on Security auditing telemetry (file object access) that includes the accessed file name and the accessing process, then suppresses expected activity from system and common program locations and Microsoft Defender-related processes.
references:
  - https://ipurple.team/2024/09/10/browser-stored-credentials/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/builtin/security/win_security_file_access_browser_credential.yml
author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali, Huntrule Team
date: 2024-10-21
tags:
  - attack.credential-access
  - attack.t1555.003
  - detection.threat-hunting
logsource:
  product: windows
  service: security
  definition: 'Requirements: Audit File System subcategory must be enabled. Additionally, each listed ObjectName must have "List folder/read data" auditing enabled.'
detection:
  selection_eid:
    EventID: 4663
    ObjectType: File
    AccessMask: "0x1"
  selection_browser_chromium:
    ObjectName|contains:
      - \User Data\Default\Login Data
      - \User Data\Local State
      - \User Data\Default\Network\Cookies
  selection_browser_firefox:
    FileName|endswith:
      - \cookies.sqlite
      - \places.sqlite
      - release\key3.db
      - release\key4.db
      - release\logins.json
  filter_main_system:
    ProcessName: System
  filter_main_generic:
    ProcessName|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_optional_defender:
    ProcessName|startswith: C:\ProgramData\Microsoft\Windows Defender\
    ProcessName|endswith:
      - \MpCopyAccelerator.exe
      - \MsMpEng.exe
  condition: selection_eid and 1 of selection_browser_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1