CookieGuard v1.3.4

CookieGuard v1.3.4

What went wrong in your test

CookieGuard detected the Epsilon payload (winhost.exe, Electron with
--user-data-dir=...\Temp\epsilon and --app-path=...\resources\app.asar) but
did not stop it, because:

1. enforcement is OFF by default, and
2. the payload was only review, so --protect (high-only) would not act.

Fixed

• New high signal electron_asar_payload: an unsigned Electron app.asar
  payload running from a user-writable location is now high. --protect and the
  window's High mode terminate it.
• Enforcement now terminates the whole process tree (children first), so the
  gpu-process / utility / renderer children cannot outlive the loader.
• The window enforcement button cycles Off -> High -> Aggressive.

How to actually block (opt-in)

# High only (remote-debugging + unsigned Electron app.asar):
.\cookieguard-tray.exe run --protect --interval 500ms
# Aggressive (also unsigned + user-writable, e.g. plain loaders):
.\cookieguard.exe run --protect-review --interval 500ms

Every action is logged as a terminate record with a reason.

Safety

• Run samples only in an isolated VM / Windows Sandbox, never on a real machine.
• A false positive can end a legitimate program. --protect* is your choice.
• Still not read-time prevention; short-lived reads can be missed.

Assets

cookieguard.exe, cookieguard-tray.exe, simulate.exe, fakecookies.exe, SHA256SUMS.txt

Türkçe

Epsilon yükü tespit edildi ama engellenmedi çünkü engelleme kapalıydı ve yük
yalnızca review idi. Artık imzasız Electron app.asar yükü yüksek sinyal;
--protect sonlandırır. Engelleme tüm süreç ağacını öldürür (önce çocuklar).
Pencere düğmesi Kapalı -> Yüksek -> Agresif. Örnekleri asla gerçek makinede
çalıştırmayın.

CookieGuard v1.3.3

CookieGuard v1.3.3

Why a fast stealer produced no log

Handle sampling only sees a file handle that is OPEN at the scan instant. A
stealer that opens, reads, and closes a browser database in milliseconds - as
Electron/NSIS payloads such as Epsilon often do - can fall between two scans, so
nothing is logged.

New: process-creation monitoring

--processes (default on) reports a newly started unsigned process running from
a user-writable/temporary location as process_started. Loader and Electron
payload chains are therefore visible even when no browser-data handle is ever
caught open. The associated-family list includes Epsilon. Disable with
--processes=false.

Example (verified live):

{"kind":"process_started","level":"review",
 "signals":[{"id":"user_writable_binary"},{"id":"unsigned_binary"}],
 "process":{"name":"payload.exe","path":"C:\\Users\\...\\AppData\\Local\\Temp\\payload.exe"},
 "associated_families":["Lumma Stealer","RedLine Stealer","Vidar","Raccoon Stealer","Agent Tesla","Rhadamanthys","Gremlin","DarkCloud","Epsilon Stealer"]}

Honest limits

• Still misses a payload that is signed, runs from Program Files, or exits before
  the next scan.
• True read-time coverage needs an access audit (SACL + Security event 4663) or a
  minifilter - not implemented yet.

Try it in the sandbox

.\cookieguard-tray.exe gui --interval 500ms
# enforcement (opt-in): an unsigned user-writable process can be terminated
.\cookieguard.exe run --protect-review --interval 500ms

Assets

cookieguard.exe, cookieguard-tray.exe, simulate.exe, fakecookies.exe, SHA256SUMS.txt

Türkçe

Hızlı bir stealer aç-oku-kapat yaptığı için handle taramasına takılmayabilir.
Artık --processes kullanıcı-yazılabilir konumdan başlayan imzasız yeni süreçleri
process_started olarak bildirir; Epsilon tarzı Electron/NSIS zincirleri görünür.
İmzalı, Program Files'tan çalışan veya hemen kapanan yükler hâlâ kaçabilir.
Gerçek okuma-anı kapsaması için erişim denetimi/minifilter gerekir.

CookieGuard v1.3.2

CookieGuard v1.3.2

Fix

Your log showed only the browser reading its own files. That was a false-positive
bug: a weak hint (browser_launched_by_untrusted_parent) downgraded a signed
browser in its expected layout from expected to review, so normal
self-access was shown.

Now:

• expected (signed browser, expected layout) is decided by the browser's own
  identity; weak review hints no longer downgrade it. Only a high signal
  overrides it.
• Normal browser self-access is hidden by default again. Use --include-browsers
  to see it on purpose.
• Event output now includes LEVEL= and PARENT= for triage.

Why a real stealer may still be missed

Handle sampling only sees a file handle that is open at the scan instant. A
stealer that opens, reads, and closes in a few milliseconds can fall between two
scans. Lower --interval (e.g. 250ms) and make the process hold the file
open longer. True read-time coverage needs an access-audit (SACL + Security event
4663) or a minifilter design - not implemented yet; that is the next step.

Assets

cookieguard.exe, cookieguard-tray.exe, simulate.exe, fakecookies.exe, SHA256SUMS.txt

Verify the fix yourself

# only browser self-reads -> you should now see almost nothing by default
.\cookieguard.exe run --lang en --interval 500ms
# our benign simulator -> should appear as LEVEL=review
.\fakecookies.exe -profile $env:USERPROFILE
.\simulate.exe --profile $env:USERPROFILE --yes
# high severity demo
.\simulate.exe --remote-debugging-port 9222 --hold 20s --yes

Türkçe

Tarayıcının kendi dosyalarını okuması normaldir ve artık varsayılan olarak
gizlenir. Zayıf ebeveyn ipucu beklenen tarayıcıyı review'a düşürmez. Gerçek
bir stealer çok hızlı aç-oku-kapat yaparsa taramalar arasında kaçabilir; aralığı
düşürün. Gerçek okuma-anı kapsaması için erişim denetimi veya minifilter gerekir.

CookieGuard v1.3.1

CookieGuard v1.3.1

Windows browser-cookie & credential access monitor (defensive security). Observes readable handles to browser cookie/credential files; it is not an antivirus or a guarantee against theft.

Assets

• cookieguard.exe - console build (CLI, single scans)
• cookieguard-tray.exe - windowless build; double-click opens the GUI
• simulate.exe - benign stealer-behaviour simulator for isolated testing (open/read synthetic files, hold handles, optional --remote-debugging-port)
• fakecookies.exe - creates synthetic browser data (cookies, Local State, key4.db, logins.json)
• SHA256SUMS.txt

Test without malware (Windows Sandbox)

./sandbox/prepare.ps1 -Version v1.3.1
# then double-click sandbox\CookieGuard.generated.wsb

Inside the sandbox it creates synthetic data, starts CookieGuard, and runs the simulator in observation mode and with --protect-review to show a terminate record.

Also in this release

• Windows Sandbox test kit (sandbox/) and the benign behaviour simulator.
• Enforcement deduplicated (one termination per process per run).
• PNG logo, badges, and a polished README.

Safety

• Not code-signed; SmartScreen may warn until you sign it yourself.
• Observation, not read-time prevention. Never point the simulator at real profiles or run samples outside an isolated VM.

Türkçe

Windows tarayıcı çerez/kimlik erişim izleyicisi. simulate.exe zararsız davranış simülatörüdür; yalnızca sahte dosyaları okur. Windows Sandbox kiti ile zararlı örnek olmadan test edebilirsiniz. İmzalı değildir; örnekleri asla gerçek makinede çalıştırmayın.

CookieGuard v1.3.0

CookieGuard v1.3.0

Windows browser-cookie & credential access monitor (defensive security). Observes readable handles to browser cookie/credential files; it is not an antivirus or a guarantee against theft.

Assets

• cookieguard.exe - console build (CLI, tests, single scans)
• cookieguard-tray.exe - windowless build for login startup; double-click opens the GUI
• SHA256SUMS.txt - SHA-256 of both binaries

Highlights

• Native GUI window (double-click, or cookieguard.exe gui): live events, scan coverage, and a runtime enforcement toggle.
• Notification-area (tray) icon with open-log / open-folder / quit.
• Opt-in enforcement (--protect, --protect-review); never terminates critical Windows processes; every action is logged. Off by default.
• Threat-signal catalog (cookieguard threats) for Lumma, RedLine, Vidar, Raccoon, Agent Tesla, Rhadamanthys, Gremlin, DarkCloud, VoidStealer, Epsilon, Rakhni - shared technique context, never family attribution.
• Monitors Local State, Login Data, Web Data and Firefox key4.db/logins.json in addition to cookies and sidecars.

Build

./build.ps1 -Version v1.3.0

Notes

• Not code-signed. SmartScreen may warn until you sign it with your own certificate.
• Observation, not read-time prevention; short-lived access can be missed.

Türkçe

Windows tarayıcı çerez/kimlik dosyası erişim izleyicisi. Erişimi gözlemler; antivirüs veya kesin koruma değildir. GUI penceresi, tepsi simgesi ve isteğe bağlı engelleme (varsayılan kapalı) içerir. İmzalı değildir; imzalanana kadar SmartScreen uyarabilir.