RedLine Stealer - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/redline-stealer/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Non-Chrome Process Accessing Chrome Login Datahttps://feed.craftedsignal.io/briefs/2024-01-03-chrome-login-data-access/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-chrome-login-data-access/This analytic identifies non-Chrome processes accessing the Chrome user data file 'login data', an SQLite database containing sensitive information like saved passwords, potentially indicating credential theft attempts.This detection identifies processes other than Chrome accessing the "Login Data" file, an SQLite database containing sensitive user information such as saved usernames and passwords. This file is typically located in the Chrome user profile directory. The activity is detected by monitoring Windows Security Event logs (EventCode 4663) for object access events. The analytic aims to detect unauthorized attempts by malware or threat actors to steal credentials stored within the Chrome browser. This activity is particularly concerning because successful credential theft can lead to unauthorized access to sensitive accounts and potential privilege escalation within the compromised environment. Observed threat actors leveraging this technique include RedLine Stealer, DarkGate Malware, NjRAT, Phemedrone Stealer, and other credential stealers and RATs.

Attack Chain

  1. The attacker gains initial access to the system through various means (e.g., phishing, exploit).
  2. The attacker executes a malicious program (e.g., RedLine Stealer) on the compromised endpoint.
  3. The malicious program attempts to access the Chrome "Login Data" file located in the user's profile directory (e.g., C:\\Users\\<username>\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data).
  4. The Windows Security Event Log generates an Event ID 4663, recording the access attempt.
  5. The malicious program reads the "Login Data" SQLite database, extracting saved usernames, passwords, and website URLs.
  6. The extracted credentials are then exfiltrated to the attacker's command-and-control (C2) server.
  7. The attacker uses the stolen credentials to access sensitive accounts, potentially leading to data breaches, financial fraud, or further lateral movement within the network.

Impact

Compromised Chrome login data can expose user credentials for various online services, including banking, email, and social media accounts. A successful attack can lead to financial loss, identity theft, and unauthorized access to sensitive corporate resources. Organizations using Chrome as their primary browser are particularly vulnerable. The number of affected users depends on the scope of the initial compromise.

Recommendation

  • Enable "Audit Object Access" in Group Policy and configure auditing for both "Success" and "Failure" events to generate Windows Security Event 4663, as required by the Splunk search query.
  • Deploy the Sigma rule "Detect Non-Chrome Process Accessing Chrome Login Data" to your SIEM to identify unauthorized access attempts to the Chrome "Login Data" file.
  • Investigate any alerts generated by the Sigma rule, focusing on identifying the source process and the context of the access.
  • Consider implementing application control policies to restrict which processes can access sensitive files like the Chrome "Login Data" file.
  • Educate users about the risks of phishing and social engineering attacks, which are common initial access vectors for malware that steals credentials.
]]>highthreatcredential-accessstealerchrome