Sigma rule: Access To Chromium Browsers Sensitive Files By Uncommon Applications

Rule

Title

Access To Chromium Browsers Sensitive Files By Uncommon Applications

Status

test

Level

low

Author

X__Junior (Nextron Systems)

Date

2024-07-29

File

rules-threat-hunting/windows/file/file_access/file_access_win_browsers_chromium_sensitive_files.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file access requests to chromium based browser sensitive files by uncommon processes.
Could indicate potential attempt of stealing sensitive information.

Log source

product

windows

category

file_access

definition

Requirements: Microsoft-Windows-Kernel-File ETW provider

Detection

selection:
    FileName|contains:
        - '\User Data\Default\Cookies'
        - '\User Data\Default\History'
        - '\User Data\Default\Network\Cookies'
        - '\User Data\Default\Web Data'
filter_main_system:
    Image: System
filter_main_generic:
    # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
    Image|startswith:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\system32\'
        - 'C:\Windows\SysWOW64\'
filter_optional_defender:
    Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
    Image|endswith:
        - '\MpCopyAccelerator.exe'
        - '\MsMpEng.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Antivirus, Anti-Spyware, Anti-Malware Software
• Backup software
• Legitimate software installed on partitions other than "C:\"
• Searching software such as "everything.exe"

Tags

• attack.t1003
• attack.credential-access
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1003

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/file/file_access/file_access_win_browsers_chromium_sensitive_files.yml