Add macOS rule for browser credential database query via a database CLI utility

rules/macos/process_creation/proc_creation_macos_browser_credential_db_query_via_db_cli.yml

@@ -0,0 +1,43 @@
+title: Browser Credential Database Query Via Database CLI Utility - MacOS
+id: 4e0d4a1c-8d2b-4d19-9c1e-2a4f8e6b7c35
+related:
+    - id: 24c77512-782b-448a-8950-eddb0785fc71
+      type: similar
+    - id: 4833155a-4053-4c9c-a997-777fcea0baa7
+      type: similar
+status: experimental
+description: |
+    Detects a command line database client such as "sqlite3" or "duckdb" reading a browser credential, cookie or autofill database.
+    Chromium stores these in "Login Data", "Cookies" and "Web Data", and Firefox stores them in "cookies.sqlite" and "key4.db".
+    Because "sqlite3" ships with macOS and is signed by Apple, this technique lets an attacker read the databases without dropping an unsigned binary on the host.
+    Opening the database through a "file:" URI with the "immutable=1" parameter also avoids the lock that a running browser holds, so the browser does not have to be killed first.
+references:
+    - https://www.loobins.io/binaries/sqlite3/
+    - https://redcanary.com/blog/threat-intelligence/clipping-silver-sparrows-wings/
+    - https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/
+author: clivoa
+date: 2026-08-15
+tags:
+    - attack.credential-access
+    - attack.t1555.003
+    - attack.t1539
+logsource:
+    category: process_creation
+    product: macos
+detection:
+    selection_img:
+        Image|endswith:
+            - '/sqlite3'
+            - '/duckdb'
+    selection_db:
+        CommandLine|contains:
+            - 'Login Data'
+            - 'Web Data'
+            - '/Cookies'
+            - 'cookies.sqlite'
+            - 'key4.db'
+    condition: all of selection_*
+falsepositives:
+    - Backup, migration or browser forensics tooling that reads these databases through a database CLI utility
+    - Administrators or developers inspecting their own browser profile from a terminal
+level: medium