security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add other browser

Browse Source
This commit is contained in:
frack113
2022-02-03 06:38:43 +01:00
parent 0bcb842c70
commit 8eeadb9beb
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/posh_ps_access_to_opera_login_data.yml → rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml
+7 -2
View File
@@ -1,4 +1,4 @@
title: Access to Opera Login Data
title: Access to Browser Login Data
id: fc028194-969d-4122-8abe-0470d5b8f12f
status: experimental
author: frack113
@@ -19,7 +19,12 @@ detection:
- Copy-Item
- '-Destination'
selection_path:
ScriptBlockText|contains: '\Opera Software\Opera Stable\Login Data'
ScriptBlockText|contains:
- '\Opera Software\Opera Stable\Login Data'
- '\Mozilla\Firefox\Profiles'
- '\Microsoft\Edge\User Data\Default'
- '\Google\Chrome\User Data\Default\Login Data'
- '\Google\Chrome\User Data\Default\Login Data For Account'
condition: all of selection_*
falsepositives:
- Unknown