vidar

[tccontre]

Tagged

    modified:   detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
    modified:   detections/endpoint/executables_or_script_creation_in_temp_path.yml
    modified:   detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
    modified:   detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
    modified:   detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
    modified:   detections/endpoint/windows_credentials_from_password_stores_chrome_extension_access.yml
    modified:   detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
    modified:   detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
    modified:   detections/endpoint/windows_disable_or_stop_browser_process.yml
    modified:   detections/endpoint/windows_indicator_removal_via_rmdir.yml
    modified:   detections/endpoint/windows_process_injection_remote_thread.yml
    modified:   detections/endpoint/windows_query_registry_uninstall_program_list.yml
    modified:   detections/endpoint/windows_screen_capture_in_temp_folder.yml
    modified:   detections/endpoint/windows_suspicious_process_file_path.yml

New Detections

    new file:   detections/endpoint/windows_cloud_sensitive_file_read_access_by_uncommon_process

Story

    new file:   stories/vidar_stealer.yml

[onurmerdogan]

Looks great, just a few minor points and suggestion regarding increased scope for Cloud credential theft.

[nasbench]

I applied recommendations from Onur as well as other metadata/logic updates. Basically we have a single detections now that cover cloud sensitive file read access. Please keep updating it with additional paths and filters.