{"id":"a1dfd976-4852-41d4-9507-dc6590a3ccd0","title":"Suspicious File Access to Browser Credential Storage","description":"Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.\nAdversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.\nThis behavior is often commonly observed in credential stealing malware.\n","author":"frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore","status":"experimental","level":"low","date":"2025-05-22","modified":"","tags":["attack.credential-access","attack.t1555.003","attack.discovery","attack.t1217"],"technique_ids":["T1217","T1555.003"],"logsource":{"category":"file_access","product":"windows"},"falsepositives":["Antivirus, Anti-Spyware, Anti-Malware Software","Legitimate software accessing browser data for synchronization or backup purposes.","Legitimate software installed on partitions other than \"C:\\\""],"references":["https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1","https://fourcore.io/blogs/threat-hunting-browser-credential-stealing"],"source_path":"rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml","source_sha256":"497cdabe84fa601014ccb8ece37736862b4b3d0b9f4fcfb281c2e72f7f26751e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious File Access to Browser Credential Storage\nid: a1dfd976-4852-41d4-9507-dc6590a3ccd0\nstatus: experimental\ndescription: |\n    Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.\n    Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.\n    This behavior is often commonly observed in credential stealing malware.\nreferences:\n    - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1\n    - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing\nauthor: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore\ndate: 2025-05-22\ntags:\n    - attack.credential-access\n    - attack.t1555.003\n    - attack.discovery\n    - attack.t1217\nlogsource:\n    category: file_access\n    product: windows\ndetection:\n    selection_browser_paths:\n        FileName|contains:\n            - '\\Sputnik\\Sputnik'\n            - '\\MapleStudio\\ChromePlus'\n            - '\\QIP Surf'\n            - '\\BlackHawk'\n            - '\\7Star\\7Star'\n            - '\\CatalinaGroup\\Citrio'\n            - '\\Google\\Chrome'\n            - '\\Coowon\\Coowon'\n            - '\\CocCoc\\Browser'\n            - '\\uCozMedia\\Uran'\n            - '\\Tencent\\QQBrowser'\n            - '\\Orbitum'\n            - '\\Slimjet'\n            - '\\Iridium'\n            - '\\Vivaldi'\n            - '\\Chromium'\n            - '\\GhostBrowser'\n            - '\\CentBrowser'\n            - '\\Xvast'\n            - '\\Chedot'\n            - '\\SuperBird'\n            - '\\360Browser\\Browser'\n            - '\\360Chrome\\Chrome'\n            - '\\Comodo\\Dragon'\n            - '\\BraveSoftware\\Brave-Browser'\n            - '\\Torch'\n            - '\\UCBrowser\\'\n            - '\\Blisk'\n            - '\\Epic Privacy Browser'\n            - '\\Nichrome'\n            - '\\Amigo'\n            - '\\Kometa'\n            - '\\Xpom'\n            - '\\Microsoft\\Edge'\n            - '\\Liebao7Default\\EncryptedStorage'\n            - '\\AVAST Software\\Browser'\n            - '\\Kinza'\n            - '\\Mozilla\\SeaMonkey\\'\n            - '\\Comodo\\IceDragon\\'\n            - '\\8pecxstudios\\Cyberfox\\'\n            - '\\FlashPeak\\SlimBrowser\\'\n            - '\\Moonchild Productions\\Pale Moon\\'\n    selection_browser_subpaths:\n        FileName|contains:\n            - '\\Profiles\\'\n            - '\\User Data'\n    selection_cred_files:\n        - FileName|contains:\n              - '\\Login Data'\n              - '\\Cookies'\n              - '\\EncryptedStorage'\n              - '\\WebCache\\'\n        - FileName|endswith:\n              - 'cert9.db'\n              - 'cookies.sqlite'\n              - 'formhistory.sqlite'\n              - 'key3.db'\n              - 'key4.db'\n              - 'Login Data.sqlite'\n              - 'logins.json'\n              - 'places.sqlite'\n    filter_main_img:\n        Image|endswith:\n            - '\\Sputnik.exe'\n            - '\\ChromePlus.exe'\n            - '\\QIP Surf.exe'\n            - '\\BlackHawk.exe'\n            - '\\7Star.exe'\n            - '\\Sleipnir5.exe'\n            - '\\Citrio.exe'\n            - '\\Chrome SxS.exe'\n            - '\\Chrome.exe'\n            - '\\Coowon.exe'\n            - '\\CocCocBrowser.exe'\n            - '\\Uran.exe'\n            - '\\QQBrowser.exe'\n            - '\\Orbitum.exe'\n            - '\\Slimjet.exe'\n            - '\\Iridium.exe'\n            - '\\Vivaldi.exe'\n            - '\\Chromium.exe'\n            - '\\GhostBrowser.exe'\n            - '\\CentBrowser.exe'\n            - '\\Xvast.exe'\n            - '\\Chedot.exe'\n            - '\\SuperBird.exe'\n            - '\\360Browser.exe'\n            - '\\360Chrome.exe'\n            - '\\dragon.exe'\n            - '\\brave.exe'\n            - '\\torch.exe'\n            - '\\UCBrowser.exe'\n            - '\\BliskBrowser.exe'\n            - '\\Epic Privacy Browser.exe'\n            - '\\nichrome.exe'\n            - '\\AmigoBrowser.exe'\n            - '\\KometaBrowser.exe'\n            - '\\XpomBrowser.exe'\n            - '\\msedge.exe'\n            - '\\LiebaoBrowser.exe'\n            - '\\AvastBrowser.exe'\n            - '\\Kinza.exe'\n            - '\\seamonkey.exe'\n            - '\\icedragon.exe'\n            - '\\cyberfox.exe'\n            - '\\SlimBrowser.exe'\n            - '\\palemoon.exe'\n    filter_main_path:\n        Image|contains:\n            - '\\Sputnik\\'\n            - '\\MapleStudio\\'\n            - '\\QIP Surf\\'\n            - '\\BlackHawk\\'\n            - '\\7Star\\'\n            - '\\Fenrir Inc\\'\n            - '\\CatalinaGroup\\'\n            - '\\Google\\'\n            - '\\Coowon\\'\n            - '\\CocCoc\\'\n            - '\\uCozMedia\\'\n            - '\\Tencent\\'\n            - '\\Orbitum\\'\n            - '\\Slimjet\\'\n            - '\\Iridium\\'\n            - '\\Vivaldi\\'\n            - '\\Chromium\\'\n            - '\\GhostBrowser\\'\n            - '\\CentBrowser\\'\n            - '\\Xvast\\'\n            - '\\Chedot\\'\n            - '\\SuperBird\\'\n            - '\\360Browser\\'\n            - '\\360Chrome\\'\n            - '\\Comodo\\'\n            - '\\BraveSoftware\\'\n            - '\\Torch\\'\n            - '\\UCBrowser\\'\n            - '\\Blisk\\'\n            - '\\Epic Privacy Browser\\'\n            - '\\Nichrome\\'\n            - '\\Amigo\\'\n            - '\\Kometa\\'\n            - '\\Xpom\\'\n            - '\\Microsoft\\'\n            - '\\Liebao7\\'\n            - '\\AVAST Software\\'\n            - '\\Kinza\\'\n            - '\\Mozilla\\'\n            - '\\8pecxstudios\\'\n            - '\\FlashPeak\\'\n            - '\\Moonchild Productions\\'\n    filter_main_system:\n        Image: System\n        ParentImage: Idle\n    filter_main_generic:\n        Image|startswith:\n            - 'C:\\Program Files\\'\n            - 'C:\\Program Files (x86)\\'\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n    filter_optional_defender:\n        Image|contains: '\\Microsoft\\Windows Defender\\'\n        Image|endswith:\n            - '\\MpCopyAccelerator.exe'\n            - '\\MsMpEng.exe'\n    filter_optional_thor:\n        Image|endswith:\n            - '\\thor.exe'\n            - '\\thor64.exe'\n    filter_optional_msiexec:\n        ParentImage: 'C:\\Windows\\System32\\msiexec.exe'\n    filter_optional_other:\n        Image|endswith: '\\everything.exe'\n    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Antivirus, Anti-Spyware, Anti-Malware Software\n    - Legitimate software accessing browser data for synchronization or backup purposes.\n    - Legitimate software installed on partitions other than \"C:\\\"\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1217","id":"T1217","name":"Browser Information Discovery","page":"techniques/enterprise/T1217/"},{"key":"enterprise/T1555.003","id":"T1555.003","name":"Credentials from Web Browsers","page":"techniques/enterprise/T1555.003/"}],"data_path":"data/detection-rules/a1dfd976-4852-41d4-9507-dc6590a3ccd0.json","kind":"sigma"}