StealC Browser Credential Database Access by Non-Browser Process
This rule detects attempts by non-browser processes to access sensitive browser files such as 'Login Data', 'Cookies', 'Web Data', 'logins.json', 'cookies.sqlite', 'formhistory.sqlite', and 'places.sqlite'. These files often contain credentials, session tokens, and browsing history. Legitimate browser processes are excluded from this detection to reduce false positives. This activity could indicate an attempt to steal user credentials or session information.
Microsoft Sentinel (KQL)
