GIFTEDCROOK KeePass and VPN Config File Access via Suspicious Process Lineage
This rule detects unauthorized read access to sensitive credential stores (KeePass .kdbx) and VPN configuration files (OpenVPN, Cisco AnyConnect, WireGuard) by processes that are not recognized credential or VPN management software. It specifically monitors for processes exhibiting suspicious lineage, such as those spawned by PowerShell or running from the C:\ProgramData directory, which is a common technique used by attackers to hide malicious activity.
Microsoft Sentinel (KQL)
