splunk-security_content/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Possible Browser Pass View Parameter	Credentials from Web Browsers, Credentials from Password Stores	Endpoint	2021-11-22	true		Credentials from Web Browsers Credential Access Credentials from Password Stores Credential Access Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic will detect a suspicious process contains a commandline parameter related to web browser credential dumper. This technique was used by Remcos RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application to dump web browser credentials. Remcos use the "/stext" commandline to dump the credential in text format. This Hunting query is good indicator to look further for possible remcos infection within the network or possible compromised host. Since the detections is only base on the parameter command and the possible path where it will drop the text credential information, It may catch normal tools that having same command and behavior.

• Type: Hunting
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-11-22
• Author: Teoderick Contreras, Splunk
• ID: 8ba484e8-4b97-11ec-b19a-acde48001122

ATT&CK

ID	Technique	Tactic
T1555.003	Credentials from Web Browsers	Credential Access

| T1555 | Credentials from Password Stores | Credential Access |

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process  IN ("*/stext *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*", "*/LoadPasswordsOpera*", "*/LoadPasswordsSafari*" , "*/UseOperaPasswordFile*", "*/OperaPasswordFile*","*/stab*", "*/scomma*", "*/stabular*", "*/shtml*", "*/sverhtml*", "*/sxml*", "*/skeepass*" ) AND Processes.process IN ("*\\temp\\*", "*\\users\\public\\*", "*\\programdata\\*") by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `possible_browser_pass_view_parameter_filter`

Associated Analytic Story

• Remcos

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.

Required field

• _time
• Processes.dest
• Processes.user
• Processes.parent_process_name
• Processes.parent_process
• Processes.original_file_name
• Processes.process_name
• Processes.process
• Processes.process_id
• Processes.parent_process_path
• Processes.process_path
• Processes.parent_process_id

Kill Chain Phase

• Exploitation

Known False Positives

False positive is quite limited. Filter is needed

RBA

Risk Score	Impact	Confidence	Message
16.0	40	40	suspicious process process_name contains commandline process on dest

Reference

• https://www.nirsoft.net/utils/web_browser_password.html
• https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/web_browser_pass_view/sysmon.log

source | version: 1