ClickFix: Suspicious unsigned process accesses Chrome/Edge credential stores
Detects unauthorized processes attempting to modify, create, or rename sensitive browser files (Login Data or Cookies) belonging to Google Chrome or Microsoft Edge. The rule filters out known browser processes and looks for suspicious initiating processes characterized by unsigned code or execution from common staging areas like Temp folders.
Microsoft Sentinel (KQL)
