{"id":"24c77512-782b-448a-8950-eddb0785fc71","title":"SQLite Chromium Profile Data DB Access","description":"Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.","author":"TropChaud","status":"test","level":"high","date":"2022-12-19","modified":"2023-01-19","tags":["attack.credential-access","attack.t1539","attack.t1555.003","attack.collection","attack.t1005"],"technique_ids":["T1005","T1539","T1555.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"source_path":"rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml","source_sha256":"c2184f63ba4abf65aed4dc42f1f01ade648f0917defde1afb605b81399d48c81","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: SQLite Chromium Profile Data DB Access\nid: 24c77512-782b-448a-8950-eddb0785fc71\nstatus: test\ndescription: Detect usage of the \"sqlite\" binary to query databases in Chromium-based browsers for potential data stealing.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows\n    - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/\nauthor: TropChaud\ndate: 2022-12-19\nmodified: 2023-01-19\ntags:\n    - attack.credential-access\n    - attack.t1539\n    - attack.t1555.003\n    - attack.collection\n    - attack.t1005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_sql:\n        - Product: SQLite\n        - Image|endswith:\n              - '\\sqlite.exe'\n              - '\\sqlite3.exe'\n    selection_chromium:\n        CommandLine|contains:\n            - '\\User Data\\' # Most common folder for user profile data among Chromium browsers\n            - '\\Opera Software\\' # Opera\n            - '\\ChromiumViewer\\' # Sleipnir (Fenrir)\n    selection_data:\n        CommandLine|contains:\n            - 'Login Data' # Passwords\n            - 'Cookies'\n            - 'Web Data' # Credit cards, autofill data\n            - 'History'\n            - 'Bookmarks'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","page":"techniques/enterprise/T1005/"},{"key":"enterprise/T1539","id":"T1539","name":"Steal Web Session Cookie","page":"techniques/enterprise/T1539/"},{"key":"enterprise/T1555.003","id":"T1555.003","name":"Credentials from Web Browsers","page":"techniques/enterprise/T1555.003/"}],"data_path":"data/detection-rules/24c77512-782b-448a-8950-eddb0785fc71.json","kind":"sigma"}