Sagan critical stable other

[WINDOWS-POWERSHELL] Chrome Login Data Retrieval

[WINDOWS-POWERSHELL] Chrome Login Data Retrieval

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-POWERSHELL] Chrome Login Data Retrieval"; program:*PowerShell*; event_id:4103,4104,600,800; content:"AppData\Local\Google\Chrome\User Data\Default\Login Data"; nocase; content:"dpapi::chrome"; classtype:trojan-activity; sid:5010483; rev:1; metadata:updated_at 2023_10_10, mitre_tactic_id TA0006, mitre_technique_id T1555.003;)

Field Validations

Loading…

Comments (0)

Loading comments...