File Access Of Signal Desktop Sensitive Data
Detects unauthorized access to Signal Desktop's sensitive data files, specifically 'db.sqlite' which stores encrypted messages and 'config.json' which contains the decryption key. An adversary gaining access to both files can decrypt and read sensitive messages without user credentials. The rule currently focuses on the default installation path in AppData\Roaming.
Sigma
