Lazarus - Cryptocurrency Wallet Enumeration and Browser Extension Scraping

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.