Suspicious Where Execution for Browser Data Discovery

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of 'where.exe' with command-line arguments that indicate an attempt to locate sensitive browser data files. Adversaries may use this technique to discover personal information, credentials, or internal network details stored by web browsers.