SectopRAT DeployBrowserKey: Bulk Access to Browser, Wallet, and Gaming Credential Stores
Detects anomalous, bulk file access activity targeting browser credential databases, cryptocurrency wallet data, and application-specific configuration stores, characteristic of the SectopRAT 'DeployBrowserKey' command.
Microsoft Sentinel (KQL)

