Browser Credential Store Access by Non-Browser Process with DPAPI Key File Correlation
Detects unauthorized access to browser credential storage files (e.g., Login Data, Cookies, Local State) by suspicious non-browser processes such as node.exe, powershell.exe, or wscript.exe. This activity is often associated with infostealer malware, particularly in supply chain attacks where malicious scripts attempt to dump browser-saved credentials or session cookies.
YARA-L
