Windows Password Manager Discovery via Command Line
Detects command-line activity aimed at discovering password manager processes or database files. This technique is often used by attackers during the reconnaissance phase to find stored credentials.
Microsoft Sentinel (KQL)
