Windows SQLite CLI Querying Chromium Browser Profile Databases
Alerts when SQLite CLI is used to query Chromium-based browser profile databases containing logins, cookies, or history.
- Product
- windows
- Category
- process_creation
- Author
- TropChaud (SigmaHQ), DRL 1.1
- Published
- 2022-12-19
- Updated
- 2026-07-30
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of the SQLite command-line tools (sqlite.exe or sqlite3.exe) whose command line references Chromium-based browser profile directories (such as User Data, Opera Software, or ChromiumViewer). It further narrows matches to SQLite queries targeting common browser data stores like Login Data, Cookies, Web Data, History, or Bookmarks. This behavior is important because attackers can use SQLite access to extract sensitive browser-stored information, and the rule relies on Windows process creation telemetry with command-line details.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows
- blog.cyble.comhttps://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows SQLite CLI Querying Chromium Browser Profile Databases
id: 691262fe-afb2-4fcf-8f74-5b88caf97fe8
status: test
description: This rule flags process executions of the SQLite command-line tools (sqlite.exe or sqlite3.exe) whose command line references Chromium-based browser profile directories (such as User Data, Opera Software, or ChromiumViewer). It further narrows matches to SQLite queries targeting common browser data stores like Login Data, Cookies, Web Data, History, or Bookmarks. This behavior is important because attackers can use SQLite access to extract sensitive browser-stored information, and the rule relies on Windows process creation telemetry with command-line details.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows
- https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml
author: TropChaud, Huntrule Team
date: 2022-12-19
modified: 2023-01-19
tags:
- attack.credential-access
- attack.t1539
- attack.t1555.003
- attack.collection
- attack.t1005
logsource:
category: process_creation
product: windows
detection:
selection_sql:
- Product: SQLite
- Image|endswith:
- \sqlite.exe
- \sqlite3.exe
selection_chromium:
CommandLine|contains:
- \User Data\
- \Opera Software\
- \ChromiumViewer\
selection_data:
CommandLine|contains:
- Login Data
- Cookies
- Web Data
- History
- Bookmarks
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 24c77512-782b-448a-8950-eddb0785fc71
type: derived