rule LINUX_Browser_Cookie_Theft_Chromium_Paths
{
    meta:
        description = "Linux: riferimenti a path cookie Chromium-based (Chrome/Chromium/Brave/Edge)"
        severity = "high"
        fix_notes = "FP fix: aggiunto check ELF - senza questo qualsiasi file testuale con questi path triggera la regola"

    strings:
        $p1 = "/.config/google-chrome/Default/Cookies" ascii
        $p2 = "/.config/chromium/Default/Cookies" ascii
        $p3 = "/.config/BraveSoftware/Brave-Browser/Default/Cookies" ascii
        $p4 = "/.config/microsoft-edge/Default/Cookies" ascii
        $p5 = "/Default/Cookies" ascii
        $p6 = "/Profile 1/Cookies" ascii
        $p7 = "/Profile 2/Cookies" ascii

    condition:
        uint32(0) == 0x7f454c46 and
        any of them
}