Infostealer Crypto Wallet File Access - StealC/Amadey
This rule detects suspicious file read or access events on common cryptocurrency wallet application folders (Electrum, Coinbase, Exodus), specific wallet files (wallet.dat), or browser extension folders associated with MetaMask. The rule specifically excludes legitimate access by the wallet applications themselves or common browsers to reduce false positives, indicating that an unauthorized process might be attempting to access sensitive cryptocurrency data.
Microsoft Sentinel (KQL)
