Sensitive data can be collected from local system sources, such as the file system or databases of information residing on the system prior to Exfiltration.Adversaries will often search the file system on computers they have compromised to find files of interest. They may do this using a Command-Line Interface, such as cmd, which has functionality to interact with the file system to gather information. Some adversaries may also use Automated Collection on the local system.
This test uses grep to search a macOS Safari binaryCookies file for specified values. This was used by CookieMiner malware.
Upon successful execution, MacOS shell will cd to ~/Libraries/Cookies and grep for Cookies.binarycookies.
Supported Platforms: macOS
| Name | Description | Type | Default Value |
|---|---|---|---|
| search_string | String to search Safari cookies to find. | string | coinbase |
cd ~/Library/Cookies
grep -q "#{search_string}" "Cookies.binarycookies"