Infostealer Logs Expose Replayable AI Session Tokens: Detecting and Remediating Stolen Google, Anthropic, and LLM API Credentials

---
title: Suspicious Access to Browser Cookie and Credential Stores
id: 3f8a1c42-7b9d-4e21-a6f5-2c8d9e0b1a34
status: experimental
description: Detects non-browser processes accessing browser cookie databases, Login Data, or Local State files — consistent with infostealer credential harvesting (Lumma, Vidar, RedLine TTPs).
references:
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_access
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
      - '\AppData\Local\BraveSoftware\Brave-Browser\User Data\'
  selection_files:
    TargetFilename|endswith:
      - '\Cookies'
      - '\Login Data'
      - '\Local State'
      - 'cookies.sqlite'
      - 'logins.json'
      - 'key4.db'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  condition: selection_paths and selection_files and not filter_browsers
falsepositives:
  - Endpoint backup agents and EDR processes legitimately scanning user profiles
  - Password managers with browser integration (rare direct file access)
level: high
---
title: DPAPI Master Key Access by Non-System Process
id: 9c2e5f18-4a6b-4d83-b1e7-5f3a8c02d946
status: experimental
description: Detects processes accessing DPAPI master key files, a prerequisite step stealers use to decrypt browser cookie and credential stores.
references:
  - https://attack.mitre.org/techniques/T1555/004/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1555.004
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\AppData\Roaming\Microsoft\Protect\'
  filter_legit:
    Image|endswith:
      - '\svchost.exe'
      - '\lsass.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\explorer.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate applications using DPAPI (Azure CLI, some VPN clients) — tune against your software inventory
level: medium
---
title: API Key and .env File Access by Non-Development Process
id: 5d1b7e93-8c4a-4f29-a3d6-7e2b9c14f058
status: experimental
description: Detects access to common secret-bearing files (.env, cloud CLI credentials, AI tool config) by processes that should never read them — indicative of stealer file-grabbing routines.
references:
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\.env'
      - '\.env.local'
      - '\credentials'
      - '\config.json'
    TargetFilename|contains:
      - '\.aws\'
      - '\.azure\'
      - '\.config\gcloud\'
      - '\.anthropic\'
      - '\.openai\'
  filter_dev:
    Image|endswith:
      - '\code.exe'
      - '\devenv.exe'
      - '\idea64.exe'
      - '\node.exe'
      - '\python.exe'
      - '\git.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection and not filter_dev
falsepositives:
  - Build tools and CI agents not covered by the filter list — extend filters per environment
level: high

// Hunt: Non-browser processes touching browser credential/cookie stores (Defender for Endpoint)
// Tune KnownGoodProcesses to your environment before production deployment.
let BrowserStores = dynamic(["\\Cookies", "\\Login Data", "\\Local State", "cookies.sqlite", "logins.json", "key4.db"]);
let KnownGoodProcesses = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "MsMpEng.exe", "OneDrive.exe"]);
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\", "\\Mozilla\\Firefox\\Profiles\\", "\\Brave-Browser\\User Data\\")
| where FileName has_any (BrowserStores)
| where not(InitiatingProcessFileName has_any (KnownGoodProcesses))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256, FileName, FolderPath, ReportId
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), FilesAccessed = make_set(FileName, 20)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256
| order by LastSeen desc;

// Hunt: Outbound connections from processes that recently accessed browser stores — potential stealer exfil
let SuspectProcesses =
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where FolderPath has_any ("\\User Data\\Default\\Network\\Cookies", "\\Protect\\")
    | where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "svchost.exe", "lsass.exe"))
    | summarize by DeviceId, InitiatingProcessFileName, InitiatingProcessSHA256;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceId in (SuspectProcesses | project DeviceId)
| where InitiatingProcessFileName in (SuspectProcesses | project InitiatingProcessFileName)
| where RemotePort in (443, 80) and not(RemoteUrl has_any ("microsoft.com", "windows.com", "google.com"))
| summarize ConnectionCount = count(), RemoteTargets = make_set(RemoteUrl, 25), RemoteIPs = make_set(RemoteIP, 25)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
| order by ConnectionCount desc;

-- Hunt for infostealer staging artifacts and browser-store access indicators
-- Combines: recent process execution matching stealer patterns, suspicious files in Temp/AppData,
-- and ZIP archives consistent with stealer exfil staging.

-- Part 1: Processes with stealer-like characteristics (short-lived, odd paths, random names)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\\Users\\Public\\|\\ProgramData\\[^\\]+\.exe$)'
  AND NOT Exe =~ '(?i)(setup|installer|update|7z|winrar)'

-- Part 2: Stealer staging archives in user temp directories (common Lumma/Vidar pattern)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\Temp\\*.zip', accessor='ntfs')
WHERE Mtime > Now() - 86400*7

-- Part 3: Processes with established outbound connections from non-standard binary paths
SELECT Pid, Name, Exe, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemotePort in (80, 443)
  AND Exe =~ '(?i)(\\Temp\\|\\Users\\Public\\|\\AppData\\Roaming\\[a-z0-9]{6,}\\)'

# Infostealer exposure assessment: enumerate plaintext AI API keys and assess
# browser-store exposure across a Windows endpoint. Run elevated in a PS remoting
# session or deploy via your RMM for fleet-wide posture checks.

$findings = @()

# 1. Scan user profiles for plaintext AI provider keys in common locations
$keyPatterns = @('ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'GOOGLE_API_KEY', 'GEMINI_API_KEY', 'sk-ant-', 'sk-proj-')
$searchRoots = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName }

foreach ($root in $searchRoots) {
    $candidateFiles = Get-ChildItem -Path $root -Recurse -Include '.env', '.env.local', 'config.json', 'settings.json' `
        -ErrorAction SilentlyContinue -Depth 4
    foreach ($file in $candidateFiles) {
        $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
        foreach ($pattern in $keyPatterns) {
            if ($content -match [regex]::Escape($pattern)) {
                $findings += [PSCustomObject]@{
                    Type = 'PlaintextAPIKey'; Path = $file.FullName; Pattern = $pattern
                }
            }
        }
    }
}

# 2. Check for suspicious recently-created executables in high-risk staging paths
$suspectPaths = @("$env:TEMP", "C:\Users\Public", "C:\ProgramData")
foreach ($path in $suspectPaths) {
    Get-ChildItem -Path $path -Recurse -Include '*.exe' -ErrorAction SilentlyContinue -Depth 2 |
        Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) -and -not $_.VersionInfo.CompanyName } |
        ForEach-Object {
            $findings += [PSCustomObject]@{ Type = 'UnsignedRecentExe'; Path = $_.FullName; Pattern = $_.CreationTime }
        }
}

# 3. Verify LSA protection and Credential Guard posture (raises the bar for credential theft)
$lsaRunAsPPL = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL
$credGuard = (Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard -ErrorAction SilentlyContinue).SecurityServicesRunning
$findings += [PSCustomObject]@{ Type = 'LSAProtection'; Path = 'RunAsPPL'; Pattern = $(if ($lsaRunAsPPL -eq 1) { 'ENABLED' } else { 'DISABLED - recommend enabling' }) }

# 4. Audit: list active sessions requiring revocation if stealer infection is confirmed
Write-Host "`n=== MANUAL ACTIONS REQUIRED ON CONFIRMED INFECTION ===" -ForegroundColor Yellow
Write-Host "1. Revoke ALL active sessions at the provider (e.g., anthropic.com/settings, myaccount.google.com/permissions)"
Write-Host "2. Rotate ALL API keys found above AND any stored in the user's browsers/managers"
Write-Host "3. Reset passwords for any account whose cookies resided on this endpoint"
Write-Host "4. Review provider usage/billing logs for unauthorized API consumption`n"

$findings | Format-Table -AutoSize
$findings | Export-Csv -Path "$env:TEMP\stealer_exposure_assessment.csv" -NoTypeInformation