Protect Browser Cookies from Infostealers

Browser cookies are a prime target for infostealers like Atomic Stealer (AMOS), Banshee Stealer, and Cthulhu Stealer. With 2FA becoming more prevalent, session cookies can bypass authentication entirely. This rule uses Santa's File Access Authorization to ensure only the browser itself can read its cookie database.

This rule is safe to deploy widely as it only restricts cookie access to the browser itself. Browser extensions running in the browser process will still have access (by design).

If you use password managers or other tools that legitimately need to read browser cookies, add their signing IDs to the process list.

Some legitimate tools may need cookie access:

• Password managers importing browser credentials
• Browser profile migration tools
• Forensic analysis tools (add exceptions via Workshop tags)

1. Deploy the rule to a test host
2. Attempt to read Chrome cookies: sqlite3 ~/Library/Application\ Support/Google/Chrome/Default/Cookies "SELECT * FROM cookies LIMIT 1"
3. Verify Santa blocks the access
4. Open Chrome and verify normal operation
5. Check Workshop Events for the blocked attempt

• Santa FAA Event: Cookie Access Blocked Monitor for blocked attempts to access cookie databases Query: event_type=FileAccess AND decision=DENY AND (file_path LIKE '%/Cookies' OR file_path LIKE '%/cookies.sqlite')

• Jamf Protect: Unauthorized Cookie Access https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/browser_cookie_theft.json