FakeGit - StealC Browser Module Detected
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
Microsoft Sentinel (KQL)
