Attack Chain

1. Initial Access: An attacker gains initial access to the system through various means (e.g., phishing, exploit).
2. Privilege Escalation: The attacker escalates privileges to gain necessary access rights if required.
3. Malware Deployment: The attacker deploys malware, such as a stealer (e.g., Redline Stealer), to the compromised system.
4. Local State Access: The malware attempts to access the Chrome "Local State" file located at "*\AppData\Local\Google\Chrome\User Data\Local State".
5. Master Key Extraction: The malware extracts the encrypted master key from the "Local State" file.
6. Password Decryption: The attacker uses the extracted master key to decrypt saved passwords stored by Chrome.
7. Credential Harvesting: The attacker harvests the decrypted credentials, including usernames and passwords.
8. Lateral Movement/Data Exfiltration: The attacker uses the stolen credentials to move laterally within the network or exfiltrate sensitive data.

Impact

Successful exploitation allows attackers to steal credentials stored in Chrome. This can lead to unauthorized access to sensitive accounts, systems, and data. The references indicate this technique is used by malware families such as Redline Stealer, and many other stealers and RATs, demonstrating its widespread use. The impact includes potential data breaches, financial loss, and reputational damage.

Recommendation

• Enable "Audit Object Access" in Group Policy and configure auditing for both "Success" and "Failure" events to capture the necessary Windows Security Event logs (EventCode 4663) for effective detection.
• Deploy the provided Sigma rule to your SIEM to detect unauthorized access to the Chrome Local State file and tune it based on your environment.
• Investigate any alerts generated by the Sigma rule by examining the process accessing the Local State file (process_name, process_path) and the user context in which the access occurred.