38 lines
1.1 KiB
Text
38 lines
1.1 KiB
Text
rule LINUX_CookieCloner_Critical_Composite
|
|
{
|
|
meta:
|
|
description = "Linux: alto rischio cookie cloning (browser artefacts + keyring/libsecret + esfil)"
|
|
severity = "critical"
|
|
score = 95
|
|
response = "quarantine"
|
|
|
|
strings:
|
|
// Browser artefacts
|
|
$c1 = "/Default/Cookies" ascii
|
|
$c2 = "cookies.sqlite" ascii
|
|
$c3 = "Login Data" ascii
|
|
$c4 = "Local State" ascii
|
|
$c5 = "encrypted_value" ascii
|
|
$c6 = "host_key" ascii
|
|
$c7 = "moz_cookies" ascii
|
|
|
|
// Decryption / key storage on Linux
|
|
$k1 = "libsecret" ascii
|
|
$k2 = "gnome-keyring" ascii
|
|
$k3 = "secret_password_lookup" ascii
|
|
$k4 = "Chromium Safe Storage" ascii
|
|
$k5 = "os_crypt" ascii
|
|
$k6 = "encrypted_key" ascii
|
|
|
|
// Network / exfil
|
|
$n1 = "libcurl" ascii
|
|
$n2 = "curl_easy_setopt" ascii
|
|
$n3 = "multipart/form-data" ascii
|
|
$n4 = "application/octet-stream" ascii
|
|
$n5 = "POST" ascii
|
|
$n6 = "User-Agent:" ascii
|
|
|
|
condition:
|
|
(2 of ($c*)) and (1 of ($k*)) and (2 of ($n*))
|
|
}
|
|
|