Non-browser process reads Chrome/Edge saved password database

Ibrahim Saud@tektrix

•updated 21 days ago•0•0•6

This rule detects unauthorized processes attempting to access 'Login Data' files associated with Google Chrome or Microsoft Edge web browsers. Legitimate browser processes are excluded, so any external process attempting to read these files is potentially malicious, indicating an attempt to dump stored browser credentials.