Bulk browser credential harvesting followed by ZIP archive staging (Dolphin X looter)
Detects an untrusted process accessing sensitive browser credential and cookie files across multiple browser families and profiles in a short period, followed immediately by the creation of a ZIP archive. This pattern is consistent with the behavior of credential-stealing malware like Dolphin X, which aggregates stolen browser data into an archive for exfiltration.
Microsoft Sentinel (KQL)
