Unsigned process correlating software-inventory enumeration, browser history access, and periodic beaconing (AI Profiler pattern)
Detects an unsigned process performing a specific behavioral sequence indicative of AI-assisted target profiling: high-volume software enumeration via registry keys, unauthorized access to browser data (history, cookies, bookmarks), and periodic C2-like network beaconing. The rule requires these actions to correlate within a tight 6-hour burst and exhibit persistent beaconing behavior over at least 3 days.
Microsoft Sentinel (KQL)
