Process Accessing Browser Credential Files

nomit vyas@xoxo

•updated Apr 30, 2026•3•0•93

This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.