Infostealer Browser Credential Theft

title: Infostealer — Non-Browser Process Accesses Browser Credential DB from Suspicious Parent or Path
id: 790a46d5-2643-4afe-9718-18742e7eecd7
status: experimental
description: >
  Detects non-browser processes accessing credential database files from suspicious
  contexts — script interpreter parent, unsigned binary, or user-writable path origin.
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1059.001/
  - https://www.infostealers.com/article/2026-infostealer-trends-im-monitoring-at-hudson-rock/
  - https://blog.sekoia.io/lummac2-stealer-an-in-depth-analysis/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
  - https://security.googleblog.com/2024/09/improving-security-of-chrome-cookies.html
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
  - attack.execution
  - attack.t1059.001
  - detection.maturity.hunt
logsource:
  category: file_event
  product: windows
detection:
  # Selection A: Browser credential DB access by process with suspicious parent (ClickFix chain)
  selection_credential_path:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Google\Chrome\User Data\Local State'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Cookies'
      - '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
      - '\Mozilla\Firefox\Profiles\'
      - '\Opera Software\Opera Stable\Login Data'

  selection_suspicious_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\wmic.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'

  selection_suspicious_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Desktop\'
      - '\Public\'
      - '\ProgramData\'
    Image|endswith:
      - '.exe'

  filter_legitimate_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
      - '\chromium.exe'
      - '\GoogleUpdate.exe'
      - '\MicrosoftEdgeUpdate.exe'
      - '\elevation_service.exe'

  # Selection B: Chrome spawned with debug port (CDP bypass — EDDIESTEALER)
  selection_cdp_bypass:
    Image|endswith: '\chrome.exe'
    CommandLine|contains: '--remote-debugging-port'
    ParentImage|endswith:
      - '.exe'
  filter_cdp_known_parents:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\explorer.exe'
      - '\svchost.exe'

  # Selection C: nss3.dll loaded by non-Mozilla process (Firefox credential decryption)
  selection_nss3_non_firefox:
    ImageLoaded|endswith: '\nss3.dll'
    Image|endswith:
      - '.exe'
  filter_nss3_known_good:
    Image|endswith:
      - '\firefox.exe'
      - '\thunderbird.exe'
      - '\seamonkey.exe'
      - '\waterfox.exe'
      - '\librewolf.exe'
      - '\palemoon.exe'

  condition: >
    (selection_credential_path and (selection_suspicious_parent or selection_suspicious_path)
    and not filter_legitimate_browsers)
    or (selection_cdp_bypass and not filter_cdp_known_parents)
    or (selection_nss3_non_firefox and not filter_nss3_known_good)
falsepositives:
  - Password managers installed in non-standard paths (unlikely for enterprise software)
  - Developer tools or automation scripts legitimately testing browser automation
  - EDR products loading nss3.dll for Firefox credential inspection during on-access scan
  - Browser migration or import tools spawned from cmd.exe by IT staff
  - Software deployment scripts (SCCM/Intune) triggering browser profile operations during setup
level: medium

title: Infostealer — Combined Login Data and Local State Access by Non-Browser Process (High Confidence)
id: b8e1369a-dcdd-413a-84a0-b7a953b8ff09
status: experimental
description: >
  Detects a non-browser process accessing both Chrome Login Data and Local State in
  the same session. Combined access has no legitimate use case outside credential theft.
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
  - https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html
  - https://security.googleblog.com/2024/09/improving-security-of-chrome-cookies.html
  - https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
  - https://blog.sekoia.io/lummac2-stealer-an-in-depth-analysis/
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
  - attack.collection
  - attack.t1005
  - detection.maturity.analyst
logsource:
  category: file_event
  product: windows
detection:
  # NOTE: This rule requires temporal correlation across two file events from the same process.
  # In Sigma, this is expressed as a grouped detection requiring both TargetFilename patterns
  # to appear from the same Image within a session window. SIEM-specific correlation is
  # required for full implementation — see the KQL and SPL queries in the analyst notes below.
  # The single-event approximation (either Login Data OR Local State by non-browser) is
  # captured as selection_combined for platforms that can apply process-grouped detection.

  # Selection A: Access to Login Data (encrypted credential SQLite database)
  selection_login_data:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
      - '\Opera Software\Opera Stable\Login Data'
      - '\Chromium\User Data\Default\Login Data'

  # Selection B: Access to Local State (App-Bound Encryption master key file)
  selection_local_state:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Local State'
      - '\Microsoft\Edge\User Data\Local State'
      - '\BraveSoftware\Brave-Browser\User Data\Local State'

  # Selection C: COM access to GoogleChromeElevationService by non-updater process
  # (App-Bound Encryption bypass via IElevator::DecryptData — Sept 2024 bypass)
  selection_abe_com_bypass:
    EventID: 4688  # Process creation as COM host
    CommandLine|contains:
      - 'GoogleChromeElevationService'

  # Filter for Selection C: exclude legitimate updater invocations
  # (moved from invalid |not|contains modifier to a proper filter block)
  filter_abe_updater:
    CommandLine|contains:
      - 'GoogleUpdate'
      - 'update'
      - 'install'

  # Selection D: Cross-process memory access to chrome.exe (memory injection bypass — Vidar 2.0)
  selection_chrome_injection:
    EventID: 10  # Sysmon ProcessAccess
    TargetImage|endswith: '\chrome.exe'
    GrantedAccess|contains:
      - '0x1010'   # PROCESS_VM_READ | PROCESS_QUERY_INFORMATION
      - '0x1438'   # PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION | PROCESS_QUERY_INFORMATION
      - '0x143a'

  # Filter for Selection D: exclude known-good processes from injection detection
  # (moved from invalid |not|endswith modifier to a proper filter block)
  filter_chrome_injection_known_good:
    SourceImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\MsMpEng.exe'
      - '\SentinelAgent.exe'
      - '\CSFalconService.exe'

  filter_legitimate_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
      - '\chromium.exe'
      - '\GoogleUpdate.exe'
      - '\MicrosoftEdgeUpdate.exe'
      - '\elevation_service.exe'

  filter_system_processes:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Program Files\Windows Defender\'

  condition: >
    (selection_login_data and not (filter_legitimate_browsers or filter_system_processes))
    or (selection_local_state and not (filter_legitimate_browsers or filter_system_processes))
    or (selection_abe_com_bypass and not filter_abe_updater)
    or (selection_chrome_injection and not filter_chrome_injection_known_good)
falsepositives:
  - Enterprise password manager products (1Password, Bitwarden for Teams) — these should
    appear in the research baseline allowlist before this rule is deployed
  - Endpoint backup solutions performing AppData backup (Veeam, Acronis) — exclude by
    known backup agent path
  - EDR products performing behavioral analysis on browser credential files — verify by
    confirming the accessing process is signed by the EDR vendor and running from Program Files
  - Chrome's own elevation service (elevation_service.exe) accessing Local State — filtered
    above; if filtering fails, verify Image path is Google's installation directory
level: high

title: Infostealer — Non-Browser Process Access to Browser Credential Database (Research Baseline)
id: 632a951f-4e57-4c9f-b1dc-32641904d61f
status: experimental
description: >
  Detects any non-browser process opening browser credential database files (Login Data,
  Cookies, Local State, logins.json). Broad baseline for environmental baselining.
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
  - https://www.infostealers.com/article/2026-infostealer-trends-im-monitoring-at-hudson-rock/
  - https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion/
  - https://blog.sekoia.io/lummac2-stealer-an-in-depth-analysis/
author: "@iimp0ster"
date: 2026/03/08
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.collection
  - attack.t1005
  - detection.maturity.research
logsource:
  category: file_event
  product: windows
detection:
  selection_browser_credential_paths:
    TargetFilename|contains:
      # Chrome credential databases
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Google\Chrome\User Data\Local State'
      # Edge credential databases
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Cookies'
      - '\Microsoft\Edge\User Data\Local State'
      # Brave credential databases
      - '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
      - '\BraveSoftware\Brave-Browser\User Data\Default\Cookies'
      # Firefox credential databases
      - '\Mozilla\Firefox\Profiles\'
      # Opera credential databases
      - '\Opera Software\Opera Stable\Login Data'
      - '\Opera Software\Opera Stable\Cookies'
      # Chromium (generic)
      - '\Chromium\User Data\Default\Login Data'
  filter_legitimate_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
      - '\chromium.exe'
      - '\iexplore.exe'
      # Browser update/crash handler processes
      - '\chrome_crashpad_handler.exe'
      - '\crashpad_handler.exe'
      - '\elevation_service.exe'
      - '\GoogleUpdate.exe'
      - '\MicrosoftEdgeUpdate.exe'
  filter_system_paths:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Program Files\Windows Defender\'
  condition: selection_browser_credential_paths and not (filter_legitimate_browsers or filter_system_paths)
falsepositives:
  - Password managers (1Password, Bitwarden, Dashlane, KeePass, LastPass) accessing browser databases for import/sync
  - Backup software (Veeam, Acronis, Windows Backup) performing file-level backup of AppData
  - Antivirus on-access scanning of AppData files
  - Browser sync utilities and profile migration tools
  - IT asset management tools inventorying installed software and profiles
  - Privacy cleaners (CCleaner, BleachBit) clearing browser history/cookies
level: informational