Woodgnat ModeloRAT/Mistic Browser Credential Store Harvesting
Detects unauthorized processes accessing sensitive Google Chrome credential files (Login Data and Cookies) typically stored in the AppData local folder. This behavior is characteristic of information stealers and trojans like ModeloRAT, Backdoor.Mistic, StealC, and Amadey, which attempt to exfiltrate stored browser passwords and session cookies.
Microsoft Sentinel (KQL)
