Non-Chrome Process Accessing Chrome Default Directory

This threat brief addresses the risk of unauthorized access to the Google Chrome user data directory by non-Chrome processes on Windows systems. The Chrome default folder stores sensitive information, including login credentials, browsing history, cookies, and autofill data. Malware, such as Remote Access Trojans (RATs), information stealers, and advanced persistent threat (APT) groups like FIN7, frequently target this directory to exfiltrate sensitive user data. This activity is often associated with post-compromise behavior, where attackers aim to harvest credentials and sensitive information for lateral movement or data theft. Detecting anomalous access to this directory is crucial for identifying potential breaches and preventing further compromise.

Attack Chain

1. An attacker gains initial access to a Windows system, possibly through phishing or exploiting a software vulnerability.
2. The attacker deploys a malicious payload, such as a RAT or infostealer, onto the compromised system.
3. The malicious process enumerates the file system to locate the Chrome user data directory, typically found under C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default.
4. The malicious process attempts to access files within the Chrome user data directory.
5. The malicious process copies targeted files (e.g., Login Data, Cookies, Web Data) to a temporary location.
6. The attacker archives the collected data into a compressed file for easier exfiltration.
7. The archived data is exfiltrated to a remote server controlled by the attacker, using protocols like HTTP or FTP.
8. The attacker uses the stolen credentials and cookies to gain unauthorized access to user accounts and sensitive resources.

Impact

Compromise of the Chrome user data directory can lead to significant data theft, including login credentials, browsing history, and cookies. Successful attacks can result in unauthorized access to user accounts, financial fraud, identity theft, and further compromise of the affected system and network. The stealers target sensitive information stored within the Chrome profile, with widespread campaigns affecting numerous users across various sectors.

Recommendation

• Enable "Audit Object Access" in Group Policy and monitor Windows Security Event logs (EventCode 4663) to detect unauthorized file access attempts, as described in the event log configuration instructions.
• Deploy the Sigma rule Detect Non Chrome Process Accessing Chrome Default Dir to your SIEM to identify anomalous processes accessing the Chrome user data directory.
• Investigate any alerts generated by the Sigma rule, focusing on the ProcessName and ObjectName fields to determine the legitimacy of the access.
• Implement the Sigma rule Detect Mimikatz Accessing LSASS Process to identify credential harvesting attempts, which may precede Chrome data theft.
• Monitor network traffic for suspicious outbound connections from processes accessing the Chrome directory, using the process_accessing_chrome_default_dir_network Sigma rule.