CoolClient keylogging, clipboard, and Chromium credential store access
Detects CoolClient's data-collection module: co-occurring keylogging hook installation, clipboard access, and Chromium credential-store file access from an unsigned/non-OS-vendor process.
Microsoft Sentinel (KQL)

