Non-Firefox Process Accessing Firefox Profile Artifacts
This rule detects when a process other than Firefox itself attempts to access critical Firefox profile artifacts such as key4.db, cert9.db, logins.json, cookies.sqlite, places.sqlite, formhistory.sqlite, and prefs.js. This activity is highly suspicious as these files contain sensitive user data including credentials, browsing history, and preferences, and are typically targeted by malware for data exfiltration or credential theft. The rule leverages causality fields for investigation into the actor and the causal process.
Cortex XDR
