name: Unusual access to Web Browser Credential stores
id: 9d889b2b-ca13-4a04-8919-ff1151f23a71
version: 1.0.0
description: |
  Identifies access to Web Browser Credential stores by unusual processes.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1555
  technique.name: Credentials from Password Stores
  technique.ref: https://attack.mitre.org/techniques/T1555/
  subtechnique.id: T1555.003
  subtechnique.name: Credentials from Web Browsers
  subtechnique.ref: https://attack.mitre.org/techniques/T1555/003/

condition: >
  open_file
    and
  file.name imatches web_browser_cred_stores
    and
  ps.name not iin web_browser_binaries
    and
  ps.exe not imatches
    (
      '?:\\Program Files\\*',
      '?:\\Program Files(x86)\\*',
      '*\\Windows\\System32\\SearchProtocolHost.exe',
      '*\\Windows\\explorer.exe',
      '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
      '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MpCopyAccelerator.exe'
    )

min-engine-version: 2.0.0
