Infostealer Browser Credential Store Access via Non-Browser Process
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', and 'Web Data' files typically located in Chrome or Firefox user profiles. This behavior is indicative of credential theft or data exfiltration, as these files contain saved usernames, passwords, and session cookies.
Splunk (SPL)
