GIFTEDCROOK Multi-Store Credential Access by Non-Browser Process
This rule detects when a non-standard or unexpected process attempts to access multiple sensitive credential files simultaneously. Specifically, it monitors for file access to Chrome login data, Firefox login and cookie databases, or KeePass database files (.kdbx). By flagging processes that access two or more distinct types of these files, the rule identifies potential credential dumping or harvesting attempts by malicious software not associated with legitimate browser or password manager activity.
CQL
