Unsigned process reads Chromium credentials file

BIOC Informational

Unsigned process reads Chromium credentials file

Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

Module:: Platform Analytics
Agent event type:: File
Category:: Credential Access
Status:: Enabled

ATT&CK tactics: Credential Access (TA0006)

ATT&CK techniques: Credentials from Password Stores: Credentials from Web Browsers (T1555.003)

Indicator:

File file path = *\users\*\appdata\local\7star\7star\user data\* , *\users\*\appdata\local\amigo\user data\* , *\users\*\appdata\local\bravesoftware\brave-browser\user data\* , *\users\*\appdata\local\centbrowser\user data\* , *\users\*\appdata\local\chedot\user data\* , *\users\*\appdata\local\google chrome sxs\user data\* , *\users\*\appdata\local\chromium\user data\* , *\users\*\appdata\local\coccoc\browser\user data\* , *\users\*\appdata\local\elements browser\user data\* , *\users\*\appdata\local\epic privacy browser\user data\* , *\users\*\appdata\local\google\chrome\user data\* , *\users\*\appdata\local\kometa\user data\* , *\users\*\appdata\local\orbitum\user data\* , *\users\*\appdata\local\sputnik\sputnik\user data\* , *\users\*\appdata\local\torch\user data\* , *\users\*\appdata\local\ucozmedia\uran\user data\* , *\users\*\appdata\local\vivaldi\user data\* , *\users\*\appdata\local\yandex\yandexbrowser\user data\* , *\users\*\appdata\local\microsoft\edge\user data\* AND file name = *login data AND action type = read Process initiated by != chrome.exe AND chromedriver.exe AND amigo.exe AND brave.exe AND centbrowser.exe AND chedot.exe AND browser.exe AND epic.exe AND kometa.exe AND orbitum.exe AND torch.exe AND uran.exe AND vivaldi.exe AND msedge.exe AND cgo name != svchost.exe AND system AND cgo signature = Unsigned , Invalid Signature AND initiator signature = Unsigned , Invalid Signature Host host os != linux AND host os = windows

Preventable: yes