Sigma rule: Potential Browser Data Stealing

Rule

Title

Potential Browser Data Stealing

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-12-23

Modified

2025-03-19

File

rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.

Log source

product

windows

category

process_creation

Detection

selection_cmd:
    - CommandLine|contains:
          - 'copy-item'
          - 'copy '
          - 'cpi '
          - ' cp '
          - 'move '
          - 'move-item'
          - ' mi '
          - ' mv '
    - Image|endswith:
          - '\esentutl.exe' # akira ransomware
          - '\xcopy.exe'
          - '\robocopy.exe'
    - OriginalFileName:
          - 'esentutl.exe'
          - 'XCOPY.EXE'
          - 'robocopy.exe'
selection_path:
    CommandLine|contains:
        - '\Amigo\User Data'
        - '\BraveSoftware\Brave-Browser\User Data'
        - '\CentBrowser\User Data'
        - '\Chromium\User Data'
        - '\CocCoc\Browser\User Data'
        - '\Comodo\Dragon\User Data'
        - '\Elements Browser\User Data'
        - '\Epic Privacy Browser\User Data'
        - '\Google\Chrome Beta\User Data'
        - '\Google\Chrome SxS\User Data'
        - '\Google\Chrome\User Data\'
        - '\Kometa\User Data'
        - '\Maxthon5\Users'
        - '\Microsoft\Edge\User Data'
        - '\Mozilla\Firefox\Profiles'
        - '\Nichrome\User Data'
        - '\Opera Software\Opera GX Stable\'
        - '\Opera Software\Opera Neon\User Data'
        - '\Opera Software\Opera Stable\'
        - '\Orbitum\User Data'
        - '\QIP Surf\User Data'
        - '\Sputnik\User Data'
        - '\Torch\User Data'
        - '\uCozMedia\Uran\User Data'
        - '\Vivaldi\User Data'
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1555.003

MITRE ATT&CK ids this rule names

• T1555.003

Related rules

• fc028194-969d-4122-8abe-0470d5b8f12f (derived)

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
• https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml