Panther rules: macos

AnalysisType: scheduled_query
Description: Detects processes that contain known browser credential files in arguments.
Enabled: false
SnowflakeQuery: |
  SELECT
    *
  FROM
    panther_logs.public.crowdstrike_processrollup2
  WHERE
    commandline LIKE ANY (
      '%/Users/%/Library/Application Support/Google/Chrome/Default/Login Data%',
      '%/Users/%/Library/Application Support/Google/Chrome/Default/Cookies%',
      '%/Users/%/Library/Application Support/Google/Chrome/Profile%/Cookies%',
      '%/Users/%/Library/Cookies%',
      '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/cookies.sqlite%',
      '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/key%.db%',
      '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/logins.json%',
      '%Login Data%',
      '%Cookies.binarycookies%',
      '%key4.db%',
      '%key3.db%',
      '%logins.json%',
      '%cookies.sqlite%'
    )
    /*
    -- allowlist of applications
    and imagefilename NOT IN (
      '/bin/rm'
    )
    */
    and p_occurs_since('1 day')

DatabricksQuery: |
  SELECT
    *
  FROM
    panther_logs.crowdstrike_processrollup2
  WHERE
    (
      commandline LIKE '%/Users/%/Library/Application Support/Google/Chrome/Default/Login Data%'
      OR commandline LIKE '%/Users/%/Library/Application Support/Google/Chrome/Default/Cookies%'
      OR commandline LIKE '%/Users/%/Library/Application Support/Google/Chrome/Profile%/Cookies%'
      OR commandline LIKE '%/Users/%/Library/Cookies%'
      OR commandline LIKE '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/cookies.sqlite%'
      OR commandline LIKE '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/key%.db%'
      OR commandline LIKE '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/logins.json%'
      OR commandline LIKE '%Login Data%'
      OR commandline LIKE '%Cookies.binarycookies%'
      OR commandline LIKE '%key4.db%'
      OR commandline LIKE '%key3.db%'
      OR commandline LIKE '%logins.json%'
      OR commandline LIKE '%cookies.sqlite%'
    )
    /*
    -- allowlist of applications
    and imagefilename NOT IN (
      '/bin/rm'
    )
    */
    AND p_occurs_since('1 day')
QueryName: "MacOS Browser Credential Access"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 5

# This file is the part of the Crowdstrike FDREvent migration, and it's the equivalent of
# https://github.com/panther-labs/panther-analysis/blob/b61db1ecf3967c5f6a44c1782f8891fd5f54384d/queries/crowdstrike_queries/MacOS_Browser_Credential_Access.yml
#
AnalysisType: scheduled_query
Description: Detects processes that contain known browser credential files in arguments. (crowdstrike_fdrevent table)
Enabled: false
SnowflakeQuery: |
  SELECT
    *
  FROM panther_logs.public.crowdstrike_fdrevent
  WHERE
    fdr_event_type = 'ProcessRollup2' AND
    event:CommandLine LIKE ANY (
      '%/Users/%/Library/Application Support/Google/Chrome/Default/Login Data%',
      '%/Users/%/Library/Application Support/Google/Chrome/Default/Cookies%',
      '%/Users/%/Library/Application Support/Google/Chrome/Profile%/Cookies%',
      '%/Users/%/Library/Cookies%',
      '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/cookies.sqlite%',
      '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/key%.db%',
      '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/logins.json%',
      '%Login Data%',
      '%Cookies.binarycookies%',
      '%key4.db%',
      '%key3.db%',
      '%logins.json%',
      '%cookies.sqlite%'
    )
    /*
    -- allowlist of applications
    and event:ImageFileName NOT IN (
      '/bin/rm'
    )
    */
    and p_occurs_since('1 day')

DatabricksQuery: |
  SELECT
    *
  FROM panther_logs.crowdstrike_fdrevent
  WHERE
    fdr_event_type = 'ProcessRollup2' AND
    (
      event:CommandLine LIKE '%/Users/%/Library/Application Support/Google/Chrome/Default/Login Data%'
      OR event:CommandLine LIKE '%/Users/%/Library/Application Support/Google/Chrome/Default/Cookies%'
      OR event:CommandLine LIKE '%/Users/%/Library/Application Support/Google/Chrome/Profile%/Cookies%'
      OR event:CommandLine LIKE '%/Users/%/Library/Cookies%'
      OR event:CommandLine LIKE '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/cookies.sqlite%'
      OR event:CommandLine LIKE '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/key%.db%'
      OR event:CommandLine LIKE '%/Users/%/Library/Application Support/Firefox/Profiles/%.default/logins.json%'
      OR event:CommandLine LIKE '%Login Data%'
      OR event:CommandLine LIKE '%Cookies.binarycookies%'
      OR event:CommandLine LIKE '%key4.db%'
      OR event:CommandLine LIKE '%key3.db%'
      OR event:CommandLine LIKE '%logins.json%'
      OR event:CommandLine LIKE '%cookies.sqlite%'
    )
    /*
    -- allowlist of applications
    and event:ImageFileName NOT IN (
      '/bin/rm'
    )
    */
    AND p_occurs_since('1 day')
QueryName: "MacOS Browser Credential Access (crowdstrike_fdrevent table)"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 5