rule LINUX_Browser_Cookie_Theft_Firefox_Paths
{
    meta:
        description = "Linux: riferimenti a Firefox cookies.sqlite e profili"
        severity = "high"
        fix_notes = "FP fix: aggiunto check ELF - cookies.sqlite e profiles.ini sono presenti in backup/script legittimi"

    strings:
        $f1 = "/.mozilla/firefox/" ascii
        $f2 = "cookies.sqlite" ascii
        $f3 = "profiles.ini" ascii

    condition:
        uint32(0) == 0x7f454c46 and
        $f1 and ($f2 or $f3)
}