AI Brands as Bait - Multi-Browser DB Access by Pythonw
Detects pythonw.exe accessing multiple distinct browser credential stores within a tight 2-minute window, indicative of information stealer behavior (e.g., Vidar stealer). The rule specifically looks for access to 'Login Data', 'Cookies', 'Web Data', and 'places.sqlite' files.
Microsoft Sentinel (KQL)
