Possible Thunderbird profile data theft via file access
Detects file access events targeting the Mozilla Thunderbird profile directory on Windows systems, which may indicate unauthorized collection or theft of local email data, archives, and account configuration files.
Sigma
