Grixba SMB Browser History Enumeration Across Nine Web History Paths
Detects the Grixba infostealer (v1.5+) enumerating sensitive browser data (history, cookies, etc.) from multiple common web browsers. The rule monitors for file access events initiated by processes running from non-standard locations such as C:\Users\Public\Music\ or identified by specific .NET binary names associated with Grixba.
Microsoft Sentinel (KQL)
