Hannibal Stealer Cryptocurrency Wallet File Theft from AppData Directories
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Microsoft Sentinel (KQL)
