Chromium Credential Database Access by Non-Browser Process
This rule detects attempts by non-browser processes to access sensitive Chromium-based browser files such as 'Login Data', 'Cookies', 'History', 'Web Data', and 'Local State'. These files often contain credentials, browsing history, and other sensitive user data. The rule specifically filters for file access events where the accessing process's command line does not match known browser executables (chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe), indicating potential credential theft or data exfiltration by malicious software.
Cortex XDR
