rule LINUX_CookieCloner_High_SQLite
{
    meta:
        description = "Linux: lettura cookie via SQLite (artefatti browser + api sqlite)"
        severity = "high"
        score = 80
        response = "quarantine_or_confirm"

    strings:
        // Browser paths (Linux)
        $p1 = "/.config/google-chrome/" ascii
        $p2 = "/.config/chromium/" ascii
        $p3 = "/.config/BraveSoftware/" ascii
        $p4 = "/.config/microsoft-edge/" ascii
        $p5 = "/.mozilla/firefox/" ascii
        $p6 = "/Default/Cookies" ascii
        $p7 = "cookies.sqlite" ascii

        // SQLite API
        $s1 = "sqlite3_open" ascii
        $s2 = "sqlite3_prepare" ascii
        $s3 = "sqlite3_step" ascii
        $s4 = "sqlite3_finalize" ascii

        // Typical fields / tables
        $t1 = "FROM cookies" ascii
        $t2 = "FROM moz_cookies" ascii
        $t3 = "encrypted_value" ascii
        $t4 = "host_key" ascii

    condition:
        (2 of ($p*)) and (2 of ($s*)) and (1 of ($t*))
}