Sigma rule: Access To Crypto Currency Wallets By Uncommon Applications

Rule

Title

Access To Crypto Currency Wallets By Uncommon Applications

Status

test

Level

medium

Author

X__Junior (Nextron Systems)

Date

2024-07-29

File

rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.

Log source

product

windows

category

file_access

definition

Requirements: Microsoft-Windows-Kernel-File ETW provider

Detection

selection:
    - FileName|contains:
          - '\AppData\Roaming\Ethereum\keystore\'
          - '\AppData\Roaming\EthereumClassic\keystore\'
          - '\AppData\Roaming\monero\wallets\'
    - FileName|endswith:
          - '\AppData\Roaming\Bitcoin\wallet.dat'
          - '\AppData\Roaming\BitcoinABC\wallet.dat'
          - '\AppData\Roaming\BitcoinSV\wallet.dat'
          - '\AppData\Roaming\DashCore\wallet.dat'
          - '\AppData\Roaming\DogeCoin\wallet.dat'
          - '\AppData\Roaming\Litecoin\wallet.dat'
          - '\AppData\Roaming\Ripple\wallet.dat'
          - '\AppData\Roaming\Zcash\wallet.dat'
filter_main_system:
    Image: System
filter_main_generic:
    # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
    Image|startswith:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\system32\'
        - 'C:\Windows\SysWOW64\'
filter_optional_defender:
    Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
    Image|endswith:
        - '\MpCopyAccelerator.exe'
        - '\MsMpEng.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Antivirus, Anti-Spyware, Anti-Malware Software
• Backup software
• Legitimate software installed on partitions other than "C:\"
• Searching software such as "everything.exe"

Tags

• attack.t1003
• attack.credential-access

MITRE ATT&CK ids this rule names

• T1003

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml