InstallFix - E-Wallet and Browser Mass Scraping (T1005)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•4

Time-series correlation identifying the powershell process rapidly scraping browser extensions and local storage files. This rule detects suspicious file access patterns where a process rapidly accesses multiple files within browser-related folders (Local Extension Settings, Network Persistent State, Cookies, Login Data). A count of more than 5 unique file accesses within a one-minute window by the same process on the same device triggers the alert.