HoneyMyte CoolClient Browser Stealer File Behavior
This rule detects file behaviors associated with the HoneyMyte CoolClient browser stealer. It identifies the creation of a file named 'License.txt' within the 'C:\Users\Public\Libraries' directory, which is used by the stealer to store credentials. Additionally, it looks for access to browser login data files such as 'Login Data' and 'Local State', or the presence of 'chromeTmp' within temporary directories ('Temp', 'AppData', 'ProgramData'). The rule also specifically flags the creation of 'Local State-journal', which is indicative of the stealer's activity in decrypting browser keys.
Sigma
