Unsigned/non-standard process accessing browser credential files

Arnold Chan@slaz

•updated 20 days ago•0•0•0

This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.