Downloads Directory Cryptocurrency Wallet File Grabber
Detects file access patterns in the Downloads directory matching cryptocurrency wallet seeds, phrases, and private keys targeted by file grabbers like Amatera. The rule identifies bulk access (more than 3 sensitive files within 5 minutes) to files with specific keywords or extensions commonly associated with crypto wallets.
Microsoft Sentinel (KQL)
