Elastic Defend high stable eql

Web Browser Credential Data Accessed by Osascript

Detects when Osascript is seen accessing sensitive web browser files. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

View Source

Detection Logic

file where event.action == "open" and process.name == "osascript" and 
 file.name like~ ("cookies.sqlite", 
                  "key?.db", 
                  "logins.json", 
                  "Cookies", 
                  "Cookies.binarycookies", 
                  "Login Data")

Field Validations

Loading…

Comments (0)

Loading comments...