rule LINUX_CookieCloner_Critical_Composite
{
    meta:
        description = "Linux: alto rischio cookie cloning (browser artefacts + keyring/libsecret + esfil)"
        severity = "critical"
        score = 95
        response = "quarantine"

    strings:
        // Browser artefacts
        $c1 = "/Default/Cookies" ascii
        $c2 = "cookies.sqlite" ascii
        $c3 = "Login Data" ascii
        $c4 = "Local State" ascii
        $c5 = "encrypted_value" ascii
        $c6 = "host_key" ascii
        $c7 = "moz_cookies" ascii

        // Decryption / key storage on Linux
        $k1 = "libsecret" ascii
        $k2 = "gnome-keyring" ascii
        $k3 = "secret_password_lookup" ascii
        $k4 = "Chromium Safe Storage" ascii
        $k5 = "os_crypt" ascii
        $k6 = "encrypted_key" ascii

        // Network / exfil
        $n1 = "libcurl" ascii
        $n2 = "curl_easy_setopt" ascii
        $n3 = "multipart/form-data" ascii
        $n4 = "application/octet-stream" ascii
        $n5 = "POST" ascii
        $n6 = "User-Agent:" ascii

    condition:
        (2 of ($c*)) and (1 of ($k*)) and (2 of ($n*))
}