Bulk Login Data/Cookies access across browser profiles followed by ZIP staging
Detects a process accessing browser credential-related files (Login Data, Cookies) across three or more distinct browser profiles within a 5-minute window, followed by the creation of a ZIP archive by the same process within 10 minutes. This behavior is indicative of credential theft activities where browser profiles are harvested and bundled for exfiltration, consistent with techniques used by infostealers like Dolphin X.
Microsoft Sentinel (KQL)
