Add rules for various stealer techniques

[Still34]

Summary

This PR adds three new rules spotted amongst various types of infostealers/dumping tools (Stealc, Vidar, ChromeKatz),

1. collection/browser/get-chrome-cookiemonster.yml
   • Detects strings related to locating processes related to Chromium's CookieMonster class
   • Typically used by infostealers or memory dumpers to extract Cookies directly from Chromium-based browsers
2. collection/browser/get-chrome-elevation-service.yml
   • Detects IID and CLSIDs for Chrome ElevationService of various editions
   • Typically used by infostealers via RPC to decrypt App-bound Encryption-related data
3. collection/get-steam-token.yml
   • Detects references to known Steam tokens
   • Typically used by Vidar and its relevant families of infostealer by scanning Steam process to retrieve the user login token.

[williballenthin]

very nice, thank you!

[williballenthin]

consider using com/* features for GUIDs, described here:
https://github.com/mandiant/capa-rules/blob/f880b13f08b2b3f603e41b87c999600d71a41e78/doc/format.md#com

[williballenthin]

[Still34]

Do I just do something like com/class: <class_name> # E0 60 88 70 41 F6 11 46 88 95 7D 86 7D D3 67 5B = CLSID for Google Chrome?

[williballenthin]

yup, that's the right idea. And the comment is strictly for humans, it isn't parsed into the rule - we use a built in database of GUIDs.

...which may be a problem since I think it's only MS Windows COM entries, and may not include the Chome entries. I'd be curious to hear what happens if you try.

[Still34]

yeaah I don't think that'll work then

[Still34]

I guess to fix it someone will have to PR over here https://github.com/mandiant/capa/blob/e8ad2072458568149697a856d6e83490b2ecdaa9/capa/features/com/classes.py ?

[mr-tz]

correct, for this PR we can proceed using the bytes

[mr-tz]

Thank you!