Phantom Stealer Browser Credential File Access from explorer.exe
Detects attempts by explorer.exe to access browser credential and cookie files from common web browsers (Chrome, Edge, Firefox). This activity is highly suspicious as explorer.exe is not typically involved in legitimate access to these sensitive files, suggesting potential credential theft or reconnaissance.
Microsoft Sentinel (KQL)
