GIFTEDCROOK Browser Credential Theft via Non-Browser Process File Access
This rule detects when processes other than known web browsers (Chrome, Firefox, Edge, Opera) attempt to access sensitive browser-related files such as 'Login Data', 'Cookies', and database files. It specifically flags instances where the accessing process or its parent process originates from 'C:\ProgramData' or where the parent process is 'powershell.exe', which is a common pattern for malicious credential access tools.
Microsoft Sentinel (KQL)
