Windows Query Registry Browser List Application

This analytic detects suspicious processes accessing registry entries related to default internet browsers. It specifically looks for Windows Security Event Code 4663, which indicates an attempt to access registry paths associated with browser configurations. Adversaries often target these registry keys to gather information about installed browsers and their settings, which can lead to the theft of sensitive data like login credentials and browsing history. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, this activity could enable attackers to exfiltrate sensitive information and compromise user accounts.