34 lines
993 B
Text
34 lines
993 B
Text
rule LINUX_CookieCloner_High_SQLite
|
|
{
|
|
meta:
|
|
description = "Linux: lettura cookie via SQLite (artefatti browser + api sqlite)"
|
|
severity = "high"
|
|
score = 80
|
|
response = "quarantine_or_confirm"
|
|
|
|
strings:
|
|
// Browser paths (Linux)
|
|
$p1 = "/.config/google-chrome/" ascii
|
|
$p2 = "/.config/chromium/" ascii
|
|
$p3 = "/.config/BraveSoftware/" ascii
|
|
$p4 = "/.config/microsoft-edge/" ascii
|
|
$p5 = "/.mozilla/firefox/" ascii
|
|
$p6 = "/Default/Cookies" ascii
|
|
$p7 = "cookies.sqlite" ascii
|
|
|
|
// SQLite API
|
|
$s1 = "sqlite3_open" ascii
|
|
$s2 = "sqlite3_prepare" ascii
|
|
$s3 = "sqlite3_step" ascii
|
|
$s4 = "sqlite3_finalize" ascii
|
|
|
|
// Typical fields / tables
|
|
$t1 = "FROM cookies" ascii
|
|
$t2 = "FROM moz_cookies" ascii
|
|
$t3 = "encrypted_value" ascii
|
|
$t4 = "host_key" ascii
|
|
|
|
condition:
|
|
(2 of ($p*)) and (2 of ($s*)) and (1 of ($t*))
|
|
}
|
|
|