Process Access to Browser Memory
This detection identifies attempts by a process to open a handle to a web browser process with memory read permissions (PROCESS_VM_READ). This behavior is often associated with credential theft techniques where an adversary attempts to dump credentials, cookies, or other sensitive information from browser memory.
Microsoft Sentinel (KQL)
