Non-Firefox Process Accessing Firefox Profile Directory

This analytic identifies processes other than Firefox accessing the Firefox profile directory. The Firefox profile directory stores sensitive user information, including login credentials, browsing history, cookies, and other personal data. Unauthorized access to this directory can indicate malicious activity, such as malware (RATs, trojans, or stealers) attempting to harvest user data. This detection leverages Windows Security Event logs, specifically event ID 4663. Observed access can lead to data exfiltration, unauthorized account access, and system compromise, making it a critical indicator for security monitoring. This behavior has been associated with multiple threat actors leveraging stealers and remote access trojans.

Attack Chain

1. Malware gains initial access to the system through an unknown vector.
2. The malware executes and attempts to locate the Firefox profile directory, typically found under \AppData\Roaming\Mozilla\Firefox\Profiles*.
3. The malware leverages Windows API calls to enumerate and access files within the Firefox profile directory. This is logged as Event ID 4663 with specific AccessMask values.
4. The malware reads sensitive files such as key4.db, logins.json, and cookies.sqlite to extract credentials and browsing data.
5. The malware may use SQLite commands to query the cookies.sqlite database for session cookies.
6. The extracted data is staged in a temporary directory for exfiltration.
7. The malware establishes a command and control (C2) connection to exfiltrate the stolen data.
8. The attacker gains unauthorized access to user accounts and sensitive information.

Impact

A successful attack can result in the compromise of user credentials, leading to unauthorized access to sensitive accounts and services. Data exfiltration from the Firefox profile directory can expose personal information, browsing history, and saved passwords. This type of compromise can impact individual users, leading to identity theft and financial loss. Organizations can also be affected if employee credentials are stolen, potentially leading to broader network compromise and data breaches. Multiple stealer families (RedLine, AgentTesla, Lokibot, SnakeKeylogger, and 0bj3ctivity) target Firefox profiles.

Recommendation

• Enable "Audit Object Access" in Group Policy and configure auditing for both success and failure events for file system objects to generate Windows Security Event 4663 (see "How To Implement" in content).
• Deploy the Sigma rule Detect Non Firefox Process Access Firefox Profile Dir to your SIEM to detect unauthorized access to the Firefox profile directory (see rules).
• Investigate any alerts generated by the Sigma rule by examining the ProcessName and ObjectName to determine the legitimacy of the access (see rules).
• Review the analytic stories associated with this detection for additional context and related threats, including StealC Stealer, DarkGate Malware, and RedLine Stealer (see tags).