Potential Browser Data Stealing via Copy/Move Utilities
This rule detects potential attempts to steal browser data by monitoring process creation events for specific command-line utilities (copy, move, xcopy, robocopy, esentutl) combined with paths commonly associated with web browser user data directories. Adversaries often acquire credentials from web browsers by copying or moving these files, which may contain saved usernames and passwords.
Sigma
