Elastic Defend high stable eql

Web Browser Credential Data Accessed by Unsigned or Untrusted Process

Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

View Source

Detection Logic

file where event.action == "open" and process.executable != null and 
 file.name like~ ("cookies.sqlite", 
                  "key?.db", 
                  "logins.json", 
                  "Cookies", 
                  "Cookies.binarycookies", 
                  "Login Data") and 
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 not file.path like~ "/Users/*/Library/Application Support/Slack/Cookies" and
 not process.code_signature.signing_id like "org.mozilla.firefox" and
 not Effective_process.executable like "/Applications/Vorta.app/Contents/MacOS/vorta-darwin" and
 not (process.executable like ("/opt/homebrew/*", "/Users/*/.cursor/extensions/openai.chatgpt-*-universal/bin/macos-aarch64/*", "/Users/*/.nvm/versions/node/v*/lib/node_modules/@anthropic-ai/claude-code/vendor/ripgrep/arm64-darwin/*", "/usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-darwin-*/vendor/*/rg") and process.name == "rg") and
 not process.executable like ("/opt/homebrew/Cellar/nss/*/bin/*", "/Library/Tanium/TaniumClient/*", "/Users/*/Library/Caches/ms-playwright/*/firefox/*") and
 not process.code_signature.signing_id : ("rg-*", "rg")

Field Validations

Loading…

Comments (0)

Loading comments...