ClosedQuorum-style combined LSASS, browser, and wallet theft with Temp staging

Arnold Chan@slaz

•updated Sep 23, 2026•2•0•8

Detects a sequence of potentially malicious actions indicative of credential theft, including LSASS memory access for dumping, followed by the acquisition of browser or cryptocurrency wallet files, and the subsequent staging of data in temporary directories, all correlated by the same process and device within a 15-minute window.