{"id":"4833155a-4053-4c9c-a997-777fcea0baa7","title":"SQLite Firefox Profile Data DB Access","description":"Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.","author":"frack113","status":"test","level":"high","date":"2022-04-08","modified":"2023-01-19","tags":["attack.credential-access","attack.t1539","attack.collection","attack.t1005"],"technique_ids":["T1005","T1539"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows","https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/"],"source_path":"rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml","source_sha256":"422002eb260a5007aac377fa7078d2109825e8a90fad6646690afee7f972c0fe","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: SQLite Firefox Profile Data DB Access\nid: 4833155a-4053-4c9c-a997-777fcea0baa7\nstatus: test\ndescription: Detect usage of the \"sqlite\" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows\n    - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/\nauthor: frack113\ndate: 2022-04-08\nmodified: 2023-01-19\ntags:\n    - attack.credential-access\n    - attack.t1539\n    - attack.collection\n    - attack.t1005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_sql:\n        - Product: SQLite\n        - Image|endswith:\n              - '\\sqlite.exe'\n              - '\\sqlite3.exe'\n    selection_firefox:\n        CommandLine|contains:\n            - 'cookies.sqlite'\n            - 'places.sqlite' # Bookmarks, history\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","page":"techniques/enterprise/T1005/"},{"key":"enterprise/T1539","id":"T1539","name":"Steal Web Session Cookie","page":"techniques/enterprise/T1539/"}],"data_path":"data/detection-rules/4833155a-4053-4c9c-a997-777fcea0baa7.json","kind":"sigma"}