Windows SQLite CLI Querying Chromium Browser Profile Databases

title: Windows SQLite CLI Querying Chromium Browser Profile Databases
id: 691262fe-afb2-4fcf-8f74-5b88caf97fe8
status: test
description: This rule flags process executions of the SQLite command-line tools (sqlite.exe or sqlite3.exe) whose command line references Chromium-based browser profile directories (such as User Data, Opera Software, or ChromiumViewer). It further narrows matches to SQLite queries targeting common browser data stores like Login Data, Cookies, Web Data, History, or Bookmarks. This behavior is important because attackers can use SQLite access to extract sensitive browser-stored information, and the rule relies on Windows process creation telemetry with command-line details.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows
  - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml
author: TropChaud, Huntrule Team
date: 2022-12-19
modified: 2023-01-19
tags:
  - attack.credential-access
  - attack.t1539
  - attack.t1555.003
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_sql:
    - Product: SQLite
    - Image|endswith:
        - \sqlite.exe
        - \sqlite3.exe
  selection_chromium:
    CommandLine|contains:
      - \User Data\
      - \Opera Software\
      - \ChromiumViewer\
  selection_data:
    CommandLine|contains:
      - Login Data
      - Cookies
      - Web Data
      - History
      - Bookmarks
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 24c77512-782b-448a-8950-eddb0785fc71
    type: derived