AI Lure Touching Browser Credential Stores
This rule looks for programs with AI-themed names (e.g., chatgpt, copilot, claude) attempting to access browser credential stores, specifically targeting login data and cookies. This activity is a common step for attackers aiming to hijack user accounts. Alerts generated by this rule should prompt an investigation into the legitimacy of the initiating process. Users should be queried about recent software installations or clicked links, and security teams should be involved if the legitimacy remains unclear.
Microsoft Sentinel (KQL)
