Storm-2561 - Infostealer Browser Database Scraping (T1555.003)
Detects a payload aggressively accessing browser credential stores (Login Data, Cookies, Web Data) in a rapid sequence, specifically when initiated by processes matching common VPN client names like GlobalProtect or AnyConnect. This behavior is indicative of infostealer activity, attempting to exfiltrate sensitive browser data.
Microsoft Sentinel (KQL)
