Multi-browser credential database access by non-browser processes

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects attempts by non-browser processes to access sensitive web browser credential files such as 'Login Data', 'key4.db', and 'logins.json'. This activity is highly indicative of credential dumping or information theft, as legitimate browser processes are excluded from the detection.