Chrome Login Data SQLite File Copied via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to copy the Chrome Login Data SQLite file over SMB. The rule specifically looks for SMB traffic (port 445) containing the strings "Login Data" and "AppData\Local\Google\Chrome" (case-insensitive). This activity is indicative of an attacker trying to exfiltrate sensitive browser data, specifically stored credentials.