Steal Web Session Cookie

let LegitBrowserProcesses = dynamic([
    "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe",
    "opera.exe", "vivaldi.exe", "chromium.exe", "msedgewebview2.exe",
    "whale.exe", "iexplore.exe"
]);
let SystemAllowList = dynamic([
    "SearchIndexer.exe", "MsMpEng.exe", "SgrmBroker.exe",
    "backgroundTaskHost.exe", "WerFault.exe", "svchost.exe",
    "TiWorker.exe", "TrustedInstaller.exe"
]);
// Primary: Non-browser process accessing browser cookie stores on disk
DeviceFileEvents
| where Timestamp > ago(24h)
| where (
    FolderPath contains "Chrome\User Data"
    or FolderPath contains "Edge\User Data"
    or FolderPath contains "Firefox\Profiles"
    or FolderPath contains "BraveSoftware\Brave-Browser"
    or FolderPath contains "Opera Software\Opera Stable"
    or FolderPath contains "Vivaldi\User Data"
)
| where FileName =~ "Cookies"
    or FileName =~ "cookies.sqlite"
    or FileName =~ "cookies.sqlite-wal"
    or (FileName =~ "Local State" and FolderPath contains "User Data")
    or FileName =~ "Login Data"
| where not (InitiatingProcessFileName in~ (LegitBrowserProcesses))
| where not (InitiatingProcessFileName in~ (SystemAllowList))
| extend AccountName = coalesce(RequestAccountName, InitiatingProcessAccountName)
| extend SuspicionReason = case(
    FileName =~ "Local State",
        "Chrome/Edge master encryption key (DPAPI-wrapped AES) accessed by non-browser process",
    FileName =~ "Login Data",
        "Browser saved credentials database accessed alongside cookie store — bulk stealer pattern",
    FileName =~ "cookies.sqlite" or FileName =~ "cookies.sqlite-wal",
        "Firefox cookie SQLite database accessed by non-browser process",
    "Browser Cookies file accessed by non-browser process"
)
| extend IsScriptHost = InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| extend IsCommonStealer = InitiatingProcessFileName in~ ("python.exe", "python3.exe", "node.exe", "ruby.exe", "perl.exe", "sqlite3.exe")
| project Timestamp, DeviceName, AccountName,
          FileName, FolderPath, ActionType,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, SuspicionReason,
          IsScriptHost, IsCommonStealer
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=11 OR EventCode=10)
| eval isCookieFileAccess=if(
    EventCode="11" AND
    (match(TargetFilename, "(?i)(Chrome.User.Data|Edge.User.Data|Firefox.Profiles|BraveSoftware.Brave-Browser|Opera.Software)")) AND
    (match(TargetFilename, "(?i)(^|[\\/])Cookies$") OR match(TargetFilename, "(?i)cookies\.sqlite") OR match(TargetFilename, "(?i)Local State$") OR match(TargetFilename, "(?i)Login Data$")) AND
    NOT match(Image, "(?i)(\\\\chrome\.exe|\\\\msedge\.exe|\\\\firefox\.exe|\\\\brave\.exe|\\\\opera\.exe|\\\\vivaldi\.exe|\\\\chromium\.exe|\\\\msedgewebview2\.exe|\\\\MsMpEng\.exe|\\\\SearchIndexer\.exe|\\\\svchost\.exe)"),
    1, 0)
| eval isBrowserProcessInjection=if(
    EventCode="10" AND
    match(TargetImage, "(?i)(\\\\chrome\.exe|\\\\msedge\.exe|\\\\firefox\.exe|\\\\brave\.exe)") AND
    NOT match(SourceImage, "(?i)(\\\\chrome\.exe|\\\\msedge\.exe|\\\\firefox\.exe|\\\\brave\.exe|\\\\MsMpEng\.exe|\\\\SgrmBroker\.exe|\\\\vmtoolsd\.exe|\\\\csrss\.exe)"),
    1, 0)
| where isCookieFileAccess=1 OR isBrowserProcessInjection=1
| eval DetectionType=case(
    isCookieFileAccess=1 AND isBrowserProcessInjection=1, "CookieFileAccess+BrowserInjection",
    isCookieFileAccess=1, "BrowserCookieFileAccess",
    isBrowserProcessInjection=1, "BrowserProcessInjection",
    "Unknown")
| eval SuspicionScore=isCookieFileAccess + isBrowserProcessInjection
| eval SuspiciousProcess=coalesce(Image, SourceImage)
| eval TargetDetail=coalesce(TargetFilename, TargetImage)
| eval IsScriptHost=if(match(SuspiciousProcess, "(?i)(powershell|pwsh|cmd\.exe|wscript|cscript|mshta|python|node\.exe)"), 1, 0)
| table _time, host, User, DetectionType, SuspiciousProcess, TargetDetail, CommandLine, IsScriptHost, SuspicionScore
| sort - _time

sequence by host.id with maxspan=5m
  [file where event.action in ("creation", "modification", "access") and
   (
     (file.path like~ "*Chrome*User Data*" or file.path like~ "*Edge*User Data*" or
      file.path like~ "*Firefox*Profiles*" or file.path like~ "*BraveSoftware*Brave-Browser*" or
      file.path like~ "*Opera Software*Opera Stable*" or file.path like~ "*Vivaldi*User Data*") and
     (file.name == "Cookies" or file.name == "cookies.sqlite" or file.name == "cookies.sqlite-wal" or
      file.name == "Local State" or file.name == "Login Data")
   ) and
   not process.name in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe",
                          "vivaldi.exe", "chromium.exe", "msedgewebview2.exe",
                          "MsMpEng.exe", "SearchIndexer.exe", "SgrmBroker.exe",
                          "backgroundTaskHost.exe", "WerFault.exe", "svchost.exe",
                          "TiWorker.exe", "TrustedInstaller.exe")]
  [process where event.action == "start" and
   process.name in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe",
                     "cscript.exe", "mshta.exe", "python.exe", "python3.exe",
                     "node.exe", "ruby.exe", "perl.exe", "sqlite3.exe")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  devicehostname AS Hostname,
  username AS AccountName,
  "filename" AS AccessedFile,
  "filepath" AS FilePath,
  "processname" AS InitiatingProcess,
  "processcommandline" AS CommandLine,
  CATEGORYNAME(category) AS Category,
  QIDNAME(qid) AS EventName,
  logsourcename(logsourceid) AS LogSource
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 79)
  AND starttime > NOW() - 86400 SECONDS
  AND (
    ("filepath" ILIKE '%Chrome%User Data%' OR "filepath" ILIKE '%Edge%User Data%' OR
     "filepath" ILIKE '%Firefox%Profiles%' OR "filepath" ILIKE '%BraveSoftware%Brave-Browser%' OR
     "filepath" ILIKE '%Opera Software%Opera Stable%' OR "filepath" ILIKE '%Vivaldi%User Data%')
    AND (
      "filename" ILIKE 'Cookies' OR "filename" ILIKE 'cookies.sqlite' OR
      "filename" ILIKE 'cookies.sqlite-wal' OR "filename" ILIKE 'Local State' OR
      "filename" ILIKE 'Login Data'
    )
  )
  AND "processname" NOT ILIKE '%chrome.exe'
  AND "processname" NOT ILIKE '%msedge.exe'
  AND "processname" NOT ILIKE '%firefox.exe'
  AND "processname" NOT ILIKE '%brave.exe'
  AND "processname" NOT ILIKE '%opera.exe'
  AND "processname" NOT ILIKE '%vivaldi.exe'
  AND "processname" NOT ILIKE '%chromium.exe'
  AND "processname" NOT ILIKE '%msedgewebview2.exe'
  AND "processname" NOT ILIKE '%MsMpEng.exe'
  AND "processname" NOT ILIKE '%SearchIndexer.exe'
  AND "processname" NOT ILIKE '%SgrmBroker.exe'
  AND "processname" NOT ILIKE '%svchost.exe'
  AND "processname" NOT ILIKE '%TiWorker.exe'
  AND "processname" NOT ILIKE '%WerFault.exe'
ORDER BY starttime DESC

_sourceCategory=windows/sysmon (EventCode=11 OR EventCode=10)
| parse xml auto
| where EventCode = "11" or EventCode = "10"
| eval isCookieAccess = if(
    EventCode = "11" AND
    (TargetFilename matches "*Chrome*User Data*" OR TargetFilename matches "*Edge*User Data*" OR
     TargetFilename matches "*Firefox*Profiles*" OR TargetFilename matches "*BraveSoftware*Brave-Browser*" OR
     TargetFilename matches "*Opera Software*" OR TargetFilename matches "*Vivaldi*User Data*") AND
    (TargetFilename matches "*Cookies" OR TargetFilename matches "*cookies.sqlite*" OR
     TargetFilename matches "*Local State" OR TargetFilename matches "*Login Data") AND
    !(Image matches "*chrome.exe" OR Image matches "*msedge.exe" OR Image matches "*firefox.exe" OR
      Image matches "*brave.exe" OR Image matches "*opera.exe" OR Image matches "*vivaldi.exe" OR
      Image matches "*chromium.exe" OR Image matches "*msedgewebview2.exe" OR
      Image matches "*MsMpEng.exe" OR Image matches "*SearchIndexer.exe" OR
      Image matches "*SgrmBroker.exe" OR Image matches "*svchost.exe"),
    1, 0)
| eval isBrowserInjection = if(
    EventCode = "10" AND
    (TargetImage matches "*chrome.exe" OR TargetImage matches "*msedge.exe" OR
     TargetImage matches "*firefox.exe" OR TargetImage matches "*brave.exe") AND
    !(SourceImage matches "*chrome.exe" OR SourceImage matches "*msedge.exe" OR
      SourceImage matches "*firefox.exe" OR SourceImage matches "*brave.exe" OR
      SourceImage matches "*MsMpEng.exe" OR SourceImage matches "*SgrmBroker.exe" OR
      SourceImage matches "*vmtoolsd.exe" OR SourceImage matches "*csrss.exe"),
    1, 0)
| where isCookieAccess = 1 OR isBrowserInjection = 1
| eval DetectionType = if(isCookieAccess = 1 AND isBrowserInjection = 1, "CookieAccess+BrowserInjection",
    if(isCookieAccess = 1, "BrowserCookieFileAccess",
    if(isBrowserInjection = 1, "BrowserProcessInjection", "Unknown")))
| eval SuspiciousProcess = if(EventCode = "11", Image, SourceImage)
| eval TargetDetail = if(EventCode = "11", TargetFilename, TargetImage)
| eval IsScriptHost = if(
    SuspiciousProcess matches "*powershell*" OR SuspiciousProcess matches "*pwsh*" OR
    SuspiciousProcess matches "*cmd.exe*" OR SuspiciousProcess matches "*wscript*" OR
    SuspiciousProcess matches "*cscript*" OR SuspiciousProcess matches "*mshta*" OR
    SuspiciousProcess matches "*python*" OR SuspiciousProcess matches "*node.exe*",
    1, 0)
| fields _messageTime, Computer, User, DetectionType, SuspiciousProcess, TargetDetail, CommandLine, IsScriptHost
| sort by _messageTime desc

rule t1539_steal_web_session_cookie {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects non-browser processes accessing browser session cookie stores or credential databases, indicating potential session cookie theft (T1539)"
    severity = "HIGH"
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1539"
    reference = "https://attack.mitre.org/techniques/T1539/"
    version = "1.0"

  events:
    $file_access.metadata.event_type = "FILE_OPEN"
    $file_access.principal.hostname = $hostname
    $file_access.principal.process.file.full_path = $proc_path
    (
      re.regex($file_access.target.file.full_path,
        `(?i)(Chrome.User Data|Edge.User Data|Firefox.Profiles|BraveSoftware.Brave-Browser|Opera.Software.Opera.Stable|Vivaldi.User Data)`) and
      re.regex($file_access.target.file.full_path,
        `(?i)([\\/]Cookies$|cookies\.sqlite(-wal)?$|[\\/]Local State$|[\\/]Login Data$)`)
    )
    not re.regex($file_access.principal.process.file.full_path,
      `(?i)(\\chrome\.exe|\\msedge\.exe|\\firefox\.exe|\\brave\.exe|\\opera\.exe|\\vivaldi\.exe|\\chromium\.exe|\\msedgewebview2\.exe|\\MsMpEng\.exe|\\SearchIndexer\.exe|\\SgrmBroker\.exe|\\backgroundTaskHost\.exe|\\WerFault\.exe|\\svchost\.exe|\\TiWorker\.exe|\\TrustedInstaller\.exe)`)

  condition:
    $file_access
}

#event_simpleName=FileOpenInfo
| TargetFileName = /(?i)(Chrome.User.Data|Edge.User.Data|Firefox.Profiles|BraveSoftware.Brave-Browser|Opera.Software.Opera.Stable|Vivaldi.User.Data)/
| TargetFileName = /(?i)([\/\\]Cookies$|cookies\.sqlite(-wal)?$|[\/\\]Local.State$|[\/\\]Login.Data$)/
| ImageFileName != /(?i)(\\chrome\.exe|\\msedge\.exe|\\firefox\.exe|\\brave\.exe|\\opera\.exe|\\vivaldi\.exe|\\chromium\.exe|\\msedgewebview2\.exe|\\MsMpEng\.exe|\\SearchIndexer\.exe|\\SgrmBroker\.exe|\\backgroundTaskHost\.exe|\\WerFault\.exe|\\svchost\.exe|\\TiWorker\.exe|\\TrustedInstaller\.exe)/
| IsScriptHost := ImageFileName matches /(?i)(powershell\.exe|pwsh\.exe|cmd\.exe|wscript\.exe|cscript\.exe|mshta\.exe|python[23]?\.exe|node\.exe|ruby\.exe|perl\.exe|sqlite3\.exe)/
| IsInterpreter := ImageFileName matches /(?i)(python[23]?\.exe|node\.exe|ruby\.exe|perl\.exe|sqlite3\.exe)/
| SuspicionScore := if(IsScriptHost == true, 2, 1) + if(IsInterpreter == true, 1, 0)
| table([_timstamp, ComputerName, UserName, ImageFileName, CommandLine, TargetFileName, IsScriptHost, IsInterpreter, SuspicionScore])
| sort(field=SuspicionScore, order=desc)