Attack Chain

1. The user executes a malicious file, potentially delivered via phishing or drive-by download (not covered in source).
2. The malicious file executes and establishes persistence on the system.
3. The malware attempts to access the Firefox profile directory, located at *\AppData\Roaming\Mozilla\Firefox\Profiles*.
4. Windows Security Event 4663 is generated, logging the access attempt to the Firefox profile directory.
5. The malware reads sensitive data, such as login credentials, cookies, and browsing history, from the profile directory.
6. The stolen data is exfiltrated to a command-and-control (C2) server.
7. The attacker uses the stolen credentials to gain unauthorized access to user accounts and sensitive systems.

Impact

Successful exploitation and credential theft can lead to a wide range of negative outcomes, including unauthorized access to sensitive data, financial fraud, and further compromise of systems within the organization. The impact can range from individual user account compromise to large-scale data breaches affecting thousands of users. Industries heavily reliant on web-based applications and sensitive user data, such as finance, healthcare, and e-commerce, are particularly vulnerable. The consequences include financial losses, reputational damage, and legal liabilities.

Recommendation

• Enable “Audit Object Access” in Group Policy and configure it to log both success and failure events for object access to activate the underlying log source required for this detection.
• Deploy the provided Sigma rule to your SIEM to detect non-Firefox processes accessing Firefox profile directories.
• Investigate any alerts generated by the Sigma rule, paying close attention to the ProcessName and ObjectName to identify potentially malicious processes and the specific profile data being accessed.
• Review and update your organization’s security policies to restrict unauthorized access to sensitive user data.