Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add rule for detect browser information discovery #5112

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add rule for detect browser information discovery #5112

wants to merge 4 commits into from

Conversation

CheraghiMilad
Copy link
Contributor

@CheraghiMilad CheraghiMilad commented Dec 8, 2024 •
edited
Loading

Summary of the Pull Request

Adversaries may enumerate information about browsers to learn more about compromised environments.
Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal
information about users (e.g., banking sites, relationships/interests, social media) and details about internal
network resources like servers, tools, dashboards, or other infrastructure.

Changelog

Example Log Event

cp log

<Event>
  <System>
    <Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/>
    <EventID>1</EventID>
    <Version>5</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2024-12-08T06:57:05.129480000Z"/>
    <EventRecordID>362834</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1258" ThreadID="1258"/>
    <Channel>Linux-Sysmon/Operational</Channel>
    <Computer>caldera-virtual-machine</Computer>
    <Security UserId="0"/>
  </System>
  <EventData>
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2024-12-03 14:40:24.518</Data>
    <Data Name="ProcessGuid">{36fe7a82-1858-674f-0134-000ec1550000}</Data>
    <Data Name="ProcessId">38850</Data>
    <Data Name="Image">/usr/bin/cp</Data>
    <Data Name="FileVersion">-</Data>
    <Data Name="Description">-</Data>
    <Data Name="Product">-</Data>
    <Data Name="Company">-</Data>
    <Data Name="OriginalFileName">-</Data>
    <Data Name="CommandLine">cp .mozilla/firefox/pg4iu77h.default-release/places.sqlite /tmp</Data>
    <Data Name="CurrentDirectory">/home/caldera</Data>
    <Data Name="User">caldera</Data>
    <Data Name="LogonGuid">{36fe7a82-0000-0000-e803-000000000000}</Data>
    <Data Name="LogonId">1000</Data>
    <Data Name="TerminalSessionId">3</Data>
    <Data Name="IntegrityLevel">no level</Data>
    <Data Name="Hashes">SHA256=40ea53f38efe555c09a2c1c860379190e2af94427daaa68756874154c3fa1188</Data>
    <Data Name="ParentProcessGuid">{36fe7a82-1709-674f-d5f6-259724560000}</Data>
    <Data Name="ParentProcessId">38603</Data>
    <Data Name="ParentImage">/usr/bin/bash</Data>
    <Data Name="ParentCommandLine">bash</Data>
    <Data Name="ParentUser">caldera</Data>
  </EventData>
</Event>

browser information discovery

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Linux Pull request add/update linux related rules labels Dec 8, 2024
@CheraghiMilad
Copy link
Contributor Author

Hi,
I have 14 merge request and they work is done, can you help me to merge theirs?
Thanks
@frack113

@frack113 frack113 added the Author Input Required changes the require information from original author of the rules label Dec 14, 2024
@nasbench
Copy link
Member

Hi, I have 14 merge request and they work is done, can you help me to merge theirs? Thanks @frack113

Please refrain from asking for pull request merges. This is an open source project with maintainers that have limited time ;)

Patience is key

@CheraghiMilad
Copy link
Contributor Author

ping @nasbench @frack113

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@frack113 frack113 frack113 left review comments

@nasbench nasbench nasbench left review comments

Assignees
No one assigned
Labels
Author Input Required changes the require information from original author of the rules Linux Pull request add/update linux related rules Rules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@CheraghiMilad @nasbench @frack113