Potential Browser Data Stealing

Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555.003` Credentials from Password Stores: Credentials from Web Browsers

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_cmd`

or:
CommandLine|contains: ' cp '
CommandLine|contains: ' mi '
CommandLine|contains: ' mv '
CommandLine|contains: 'copy '
CommandLine|contains: copy-item
CommandLine|contains: 'cpi '
CommandLine|contains: 'move '
CommandLine|contains: move-item
Image|endswith: '\esentutl.exe'
Image|endswith: '\robocopy.exe'
Image|endswith: '\xcopy.exe'
OriginalFileName: XCOPY.EXE
OriginalFileName: esentutl.exe
OriginalFileName: robocopy.exe

Stage 2: `all of selection_path`

or:
CommandLine|contains: '\Amigo\User Data'
CommandLine|contains: '\BraveSoftware\Brave-Browser\User Data'
CommandLine|contains: '\CentBrowser\User Data'
CommandLine|contains: '\Chromium\User Data'
CommandLine|contains: '\CocCoc\Browser\User Data'
CommandLine|contains: '\Comodo\Dragon\User Data'
CommandLine|contains: '\Elements Browser\User Data'
CommandLine|contains: '\Epic Privacy Browser\User Data'
CommandLine|contains: '\Google\Chrome Beta\User Data'
CommandLine|contains: '\Google\Chrome SxS\User Data'
CommandLine|contains: '\Google\Chrome\User Data\'
CommandLine|contains: '\Kometa\User Data'
CommandLine|contains: '\Maxthon5\Users'
CommandLine|contains: '\Microsoft\Edge\User Data'
CommandLine|contains: '\Mozilla\Firefox\Profiles'
CommandLine|contains: '\Nichrome\User Data'
CommandLine|contains: '\Opera Software\Opera GX Stable\'
CommandLine|contains: '\Opera Software\Opera Neon\User Data'
CommandLine|contains: '\Opera Software\Opera Stable\'
CommandLine|contains: '\Orbitum\User Data'
CommandLine|contains: '\QIP Surf\User Data'
CommandLine|contains: '\Sputnik\User Data'
CommandLine|contains: '\Torch\User Data'
CommandLine|contains: '\Vivaldi\User Data'
CommandLine|contains: '\uCozMedia\Uran\User Data'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`cp` corpus 5 (sigma 5) `mi` corpus 2 (sigma 2) `mv` corpus 2 (sigma 2) `\Amigo\User Data` `\BraveSoftware\Brave-Browser\User Data` `\CentBrowser\User Data` `\Chromium\User Data` `\CocCoc\Browser\User Data` `\Comodo\Dragon\User Data` `\Elements Browser\User Data` `\Epic Privacy Browser\User Data` `\Google\Chrome Beta\User Data` `\Google\Chrome SxS\User Data` `\Google\Chrome\User Data\` `\Kometa\User Data` `\Maxthon5\Users` `\Microsoft\Edge\User Data` `\Mozilla\Firefox\Profiles` `\Nichrome\User Data` `\Opera Software\Opera GX Stable\` `\Opera Software\Opera Neon\User Data` `\Opera Software\Opera Stable\` `\Orbitum\User Data` `\QIP Surf\User Data` `\Sputnik\User Data` `\Torch\User Data` `\Vivaldi\User Data` `\uCozMedia\Uran\User Data` `copy` corpus 11 (sigma 11) `copy-item` corpus 4 (sigma 4) `cpi` corpus 4 (sigma 4) `move` corpus 2 (sigma 2) `move-item`
`Image`	ends_with	`\esentutl.exe` corpus 8 (sigma 8) `\robocopy.exe` corpus 5 (sigma 5) `\xcopy.exe` corpus 5 (sigma 5)
`OriginalFileName`	eq	`XCOPY.EXE` corpus 4 (sigma 4) `esentutl.exe` corpus 2 (sigma 2) `robocopy.exe` corpus 4 (sigma 4)