Browser Credential Access After VPN Logon
This rule detects suspicious activity where a process attempts to access browser credential files (e.g., login data, cookies) shortly after a VPN logon event on the same device and by the same user. This could indicate an attacker attempting to steal credentials after gaining initial access or establishing a VPN connection.
Microsoft Sentinel (KQL)
