Access to Browser Login Data via PowerShell Copy-Item

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•5•0•21

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. This rule detects PowerShell commands attempting to copy browser login data files from common web browsers like Opera, Firefox, Microsoft Edge, and Google Chrome.