PS1Bot Accessing Chrome/Edge Local State

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•2

Detects PowerShell accessing browser Local State files to steal credentials. This rule specifically looks for file access events where the file name is 'Local State' and the initiating process is 'powershell.exe' or 'pwsh.exe'.