ChainScript node.exe wallet_scan enumeration of desktop/browser wallets
Detects the ChainScript RAT agent (executing as node.exe from specific masquerading directory paths) scanning for and enumerating cryptocurrency wallet files, browser-stored wallet extensions, and related sensitive configuration data.
Microsoft Sentinel (KQL)
