Add rule for detect browser information discovery

[CheraghiMilad]

Summary of the Pull Request

Adversaries may enumerate information about browsers to learn more about compromised environments.
Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal
information about users (e.g., banking sites, relationships/interests, social media) and details about internal
network resources like servers, tools, dashboards, or other infrastructure.

Changelog

Example Log Event

cp log

<Event>
  <System>
    <Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/>
    <EventID>1</EventID>
    <Version>5</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2024-12-08T06:57:05.129480000Z"/>
    <EventRecordID>362834</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1258" ThreadID="1258"/>
    <Channel>Linux-Sysmon/Operational</Channel>
    <Computer>caldera-virtual-machine</Computer>
    <Security UserId="0"/>
  </System>
  <EventData>
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2024-12-03 14:40:24.518</Data>
    <Data Name="ProcessGuid">{36fe7a82-1858-674f-0134-000ec1550000}</Data>
    <Data Name="ProcessId">38850</Data>
    <Data Name="Image">/usr/bin/cp</Data>
    <Data Name="FileVersion">-</Data>
    <Data Name="Description">-</Data>
    <Data Name="Product">-</Data>
    <Data Name="Company">-</Data>
    <Data Name="OriginalFileName">-</Data>
    <Data Name="CommandLine">cp .mozilla/firefox/pg4iu77h.default-release/places.sqlite /tmp</Data>
    <Data Name="CurrentDirectory">/home/caldera</Data>
    <Data Name="User">caldera</Data>
    <Data Name="LogonGuid">{36fe7a82-0000-0000-e803-000000000000}</Data>
    <Data Name="LogonId">1000</Data>
    <Data Name="TerminalSessionId">3</Data>
    <Data Name="IntegrityLevel">no level</Data>
    <Data Name="Hashes">SHA256=40ea53f38efe555c09a2c1c860379190e2af94427daaa68756874154c3fa1188</Data>
    <Data Name="ParentProcessGuid">{36fe7a82-1709-674f-d5f6-259724560000}</Data>
    <Data Name="ParentProcessId">38603</Data>
    <Data Name="ParentImage">/usr/bin/bash</Data>
    <Data Name="ParentCommandLine">bash</Data>
    <Data Name="ParentUser">caldera</Data>
  </EventData>
</Event>

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[CheraghiMilad]

Hi,
I have 14 merge request and they work is done, can you help me to merge theirs?
Thanks
@frack113

[nasbench]

Hi, I have 14 merge request and they work is done, can you help me to merge theirs? Thanks @frack113

Please refrain from asking for pull request merges. This is an open source project with maintainers that have limited time ;)

Patience is key