Elastic high stable eql

Suspicious Web Browser Sensitive File Access

Identifies the access or file open of web browser sensitive files by an untrusted/unsigned process or osascript. Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

View Source

Detection Logic

file where event.action == "open" and host.os.type == "macos" and process.executable != null and
 file.name like~ ("cookies.sqlite",
                  "key?.db",
                  "logins.json",
                  "Cookies",
                  "Cookies.binarycookies",
                  "Login Data") and
 ((process.code_signature.trusted == false or process.code_signature.exists == false) or process.name == "osascript") and
 not process.code_signature.signing_id == "org.mozilla.firefox" and
not ?Effective_process.executable like "/Library/Elastic/Endpoint/elastic-endpoint.app/Contents/MacOS/elastic-endpoint"

Field Validations

Loading…

Comments (0)

Loading comments...