Suspicious Browser Credential Access_MuddyWater Operation Olalampo Campaign
This detection identifies attempts by non-browser processes to access credential database files associated with common web browsers, including Chrome, Edge, and Brave. Such activity is commonly leveraged by threat actors to harvest stored credentials for the purpose of lateral movement and further system compromise. Notably, this technique has been observed in campaigns attributed to MuddyWater Operation Olalampo.
Microsoft Sentinel (KQL)
