Browser Information Discovery via Command Line
This rule detects attempts to discover sensitive browser information by monitoring command-line executions. It specifically looks for processes that are not legitimate browser applications or security tools, attempting to access common browser profile paths and sensitive database files (e.g., Login Data, Cookies, History, places.sqlite, logins.json, key4.db, key3.db). This activity could indicate an adversary attempting to exfiltrate user credentials, browsing history, or other personal data stored by web browsers.
Microsoft Sentinel (KQL)
