Access To Browser Credential Files By Uncommon Applications

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•3•0•32

Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage to reduce false positives.