REMUS Infostealer: Defending Against Session Hijacking and MaaS Operations

---
title: Potential Infostealer Accessing Browser Cookies
id: 9c3e1a5b-0f7d-4e8c-9a12-3b4c5d6e7f8a
status: experimental
description: Detects non-browser processes accessing browser Cookie SQLite databases, a common behavior of stealers like REMUS.
references:
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2024/10/25
tags:
  - attack.credential_access
  - attack.t1005
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Microsoft\Edge\User Data\Default\Cookies'
      - '\BraveSoftware\Brave-Browser\User Data\Default\Cookies'
      - '\Mozilla\Firefox\Profiles\\cookies.sqlite'
  filter_legitimate_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: selection and not filter_legitimate_browsers
falsepositives:
  - Third-party backup or synchronization software
level: high
---
title: Suspicious PowerShell Accessing Browser Local Storage
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects PowerShell scripts attempting to read browser Local Storage files, indicative of manual or automated session theft.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2024/10/25
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Local Storage'
      - 'leveldb'
  condition: selection
falsepositives:
  - Administrative troubleshooting scripts
level: medium

// Hunt for non-browser processes accessing browser Cookie files
DeviceFileEvents
| where Timestamp > ago(1d)
| where TargetFilename has "Cookies" 
| where TargetFilename has @"User Data" 
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "opera.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, TargetFilename, ActionType
| order by Timestamp desc

-- Hunt for processes holding handles to browser cookie databases
SELECT Pid, Name, Exe, CommandLine, Handle.Name, Handle.Type
FROM handles()
WHERE Handle.Name =~ "\\AppData\\(Local|Roaming)\\"
  AND (
      Handle.Name =~ "\\Google\\Chrome\\User Data\\Default\\Cookies" OR
      Handle.Name =~ "\\Microsoft\\Edge\\User Data\\Default\\Cookies" OR
      Handle.Name =~ "\\Mozilla\\Firefox\\Profiles\\.*cookies.sqlite"
  )
  AND Name NOT IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "opera.exe")

# Remediation Script: Check for Suspicious Browser Access
# Run as Administrator

Write-Host "[+] Scanning for processes holding handles to browser Cookie files..." -ForegroundColor Cyan

# Define browser paths to monitor
$targetPaths = @(
    "\Google\Chrome\User Data",
    "\Microsoft\Edge\User Data",
    "\Mozilla\Firefox\Profiles"
)

# Get handles using sysinternals handle.exe or similar logic if available
# Note: This script utilizes basic process inspection if handle.exe is not present.
# In a production environment, use Sysinternals Suite for comprehensive handle auditing.

$processList = Get-Process | Where-Object { 
    $_.ProcessName -notin @("chrome", "msedge", "firefox", "brave", "opera", "explorer", "svchost")
}

$suspiciousActivity = $false

foreach ($proc in $processList) {
    # Check modules loaded (Stealers often load SQLite DLLs)
    $modules = $proc.Modules
    if ($modules.FileName -like "*sqlite*" -and $proc.ProcessName -notlike "*browser*") {
        Write-Host "[!] WARNING: Process $($proc.ProcessName) (PID: $($proc.Id)) is loading SQLite DLLs but is not a browser." -ForegroundColor Red
        Write-Host "    Path: $($proc.Path)" -ForegroundColor DarkRed
        $suspiciousActivity = $true
    }
}

if (-not $suspiciousActivity) {
    Write-Host "[*] No obvious SQLite module hijacking detected in non-browser processes." -ForegroundColor Green
}

Write-Host "[+] Recommendation: Revoke all active web sessions if infection is suspected." -ForegroundColor Yellow