← Back to SOC feed Coverage →

Steal Firefox credential

yara LOW Yara-Rules
communitycredential-theft
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-21T09:00:00Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that an adversary is attempting to exfiltrate Firefox browser credentials from a victim’s system to gain access to sensitive user accounts. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify potential credential theft activities early and prevent further lateral movement or data exfiltration.

YARA Rule

rule cred_ff {
    meta:
        author = "x0r"
        description = "Steal Firefox credential"
	version = "0.1"
    strings:
        $f1 = "signons.sqlite"
        $f2 = "signons3.txt"
        $f3 = "secmod.db"
        $f4 = "cert8.db"
        $f5 = "key3.db"
    condition:
        any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/capabilities/capabilities.yar