CookieGuard v1.3.3

CookieGuard v1.3.3

Why a fast stealer produced no log

Handle sampling only sees a file handle that is OPEN at the scan instant. A
stealer that opens, reads, and closes a browser database in milliseconds - as
Electron/NSIS payloads such as Epsilon often do - can fall between two scans, so
nothing is logged.

New: process-creation monitoring

--processes (default on) reports a newly started unsigned process running from
a user-writable/temporary location as process_started. Loader and Electron
payload chains are therefore visible even when no browser-data handle is ever
caught open. The associated-family list includes Epsilon. Disable with
--processes=false.

Example (verified live):

{"kind":"process_started","level":"review",
 "signals":[{"id":"user_writable_binary"},{"id":"unsigned_binary"}],
 "process":{"name":"payload.exe","path":"C:\\Users\\...\\AppData\\Local\\Temp\\payload.exe"},
 "associated_families":["Lumma Stealer","RedLine Stealer","Vidar","Raccoon Stealer","Agent Tesla","Rhadamanthys","Gremlin","DarkCloud","Epsilon Stealer"]}

Honest limits

• Still misses a payload that is signed, runs from Program Files, or exits before
  the next scan.
• True read-time coverage needs an access audit (SACL + Security event 4663) or a
  minifilter - not implemented yet.

Try it in the sandbox

.\cookieguard-tray.exe gui --interval 500ms
# enforcement (opt-in): an unsigned user-writable process can be terminated
.\cookieguard.exe run --protect-review --interval 500ms

Assets

cookieguard.exe, cookieguard-tray.exe, simulate.exe, fakecookies.exe, SHA256SUMS.txt

Türkçe

Hızlı bir stealer aç-oku-kapat yaptığı için handle taramasına takılmayabilir.
Artık --processes kullanıcı-yazılabilir konumdan başlayan imzasız yeni süreçleri
process_started olarak bildirir; Epsilon tarzı Electron/NSIS zincirleri görünür.
İmzalı, Program Files'tan çalışan veya hemen kapanan yükler hâlâ kaçabilir.
Gerçek okuma-anı kapsaması için erişim denetimi/minifilter gerekir.