Splunk unknown stable spl

Windows Credentials from Password Stores Chrome Login Data Access

The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.

View Source

Detection Logic

`wineventlog_security`
EventCode=4663
object_file_path="*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
NOT process_path IN (
    "*:\\Windows\\explorer.exe",
    "*:\\Windows\\System32\\dllhost.exe",
    "*\\AppData\\Local\\Google\\Chrome Beta\\Application\\chrome.exe",
    "*\\AppData\\Local\\Google\\Chrome Dev\\Application\\chrome.exe",
    "*\\AppData\\Local\\Google\\Chrome SxS\\Application\\chrome.exe",
    "*\\AppData\\Local\\Google\\Chrome Unstable\\Application\\chrome.exe",
    "*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe"
)
| stats count min(_time) as firstTime
              max(_time) as lastTime

  by object_file_name object_file_path
     process_name process_path
     process_id EventCode dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_credentials_from_password_stores_chrome_login_data_access_filter`

False Positives

⚠ The chrome uninstaller will access these set of files and folders. Filter as needed.

Field Validations

Loading…

Comments (0)

Loading comments...