Hannibal Stealer VPN Config Theft from CyberGhost/NordVPN/ExpressVPN
Detects unauthorized access to VPN configuration files associated with common VPN providers (CyberGhost, NordVPN, ExpressVPN). This behavior is characteristic of the Hannibal Stealer, which attempts to exfiltrate these files to compromise user VPN sessions and credentials. The rule filters out legitimate process access to minimize false positives.
Sigma
