Non-Firefox Process Accessing Firefox Profile Directory

This rule detects when processes other than Firefox or Windows Explorer attempt to access the Firefox profile directory. This directory contains sensitive user data like login credentials, browsing history, and cookies. Such activity, monitored via Windows Security Event 4663, could indicate malware (e.g., RATs, trojans) trying to harvest user information, potentially leading to data exfiltration, unauthorized account access, and system compromise.