Credential Harvesting from Browser and System Password Stores

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•1•0•4

This rule detects suspicious processes (e.g., cmd.exe, powershell.exe, curl.exe) or the execution of vaultcmd.exe accessing browser credential files (Login Data, Web Data, logins.json, key4.db) or utilizing DPAPI (CryptUnprotectData) to extract stored credentials. This behavior is indicative of credential harvesting often observed in infostealer campaigns.