PS1Bot Accessing Cryptocurrency Extensions

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•3

Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.