Access To Crypto Currency Wallets By Uncommon Applications

 1title: Access To Crypto Currency Wallets By Uncommon Applications
 2id: f41b0311-44f9-44f0-816d-dd45e39d4bc8
 3status: experimental
 4description: |
 5    Detects file access requests to crypto currency files by uncommon processes.
 6    Could indicate potential attempt of crypto currency wallet stealing.    
 7references:
 8    - Internal Research
 9author: X__Junior (Nextron Systems)
10date: 2024-07-29
11tags:
12    - attack.t1003
13    - attack.credential-access
14logsource:
15    category: file_access
16    product: windows
17    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
18detection:
19    selection:
20        - FileName|contains:
21              - '\AppData\Roaming\Ethereum\keystore\'
22              - '\AppData\Roaming\EthereumClassic\keystore\'
23              - '\AppData\Roaming\monero\wallets\'
24        - FileName|endswith:
25              - '\AppData\Roaming\Bitcoin\wallet.dat'
26              - '\AppData\Roaming\BitcoinABC\wallet.dat'
27              - '\AppData\Roaming\BitcoinSV\wallet.dat'
28              - '\AppData\Roaming\DashCore\wallet.dat'
29              - '\AppData\Roaming\DogeCoin\wallet.dat'
30              - '\AppData\Roaming\Litecoin\wallet.dat'
31              - '\AppData\Roaming\Ripple\wallet.dat'
32              - '\AppData\Roaming\Zcash\wallet.dat'
33    filter_main_system:
34        Image: System
35    filter_main_generic:
36        # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
37        Image|startswith:
38            - 'C:\Program Files (x86)\'
39            - 'C:\Program Files\'
40            - 'C:\Windows\system32\'
41            - 'C:\Windows\SysWOW64\'
42    filter_optional_defender:
43        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
44        Image|endswith:
45            - '\MpCopyAccelerator.exe'
46            - '\MsMpEng.exe'
47    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
48falsepositives:
49    - Antivirus, Anti-Spyware, Anti-Malware Software
50    - Backup software
51    - Legitimate software installed on partitions other than "C:\"
52    - Searching software such as "everything.exe"
53level: medium