Access To Cryptocurrency Wallets By Uncommon Applications
This rule detects attempts by uncommon applications to access cryptocurrency wallet files. It specifically looks for file access requests to common cryptocurrency wallet paths for Ethereum, Ethereum Classic, Monero, Bitcoin, BitcoinABC, BitcoinSV, DashCore, DogeCoin, Litecoin, Ripple, and Zcash. The rule filters out access by common system processes, applications installed in standard Program Files directories, and Windows Defender components to reduce false positives. This activity could indicate an attempt to steal cryptocurrency wallets.
Sigma
