Anomalous Chrome Local File Access
Detects when the Google Chrome process (chrome.exe) reads or creates an unusually high number of files in sensitive user directories within a short time frame. This behavior is indicative of file and directory discovery (T1083) and could be a post-exploitation step of a browser-based attack, such as the Gemini panel hijacking described in CVE-2026-0628, where a compromised browser process is used to access local files outside of its sandbox.
Microsoft Sentinel (KQL)
