Esentutl Steals Browser Information

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•18

This rule detects the use of 'esentutl.exe' with specific command-line arguments to extract browser data, particularly from the Windows WebCache. This activity is associated with malware like Qbot, which uses this technique to steal sensitive information from browsers such as Internet Explorer and Microsoft Edge.