GIFTEDCROOK Browser Credential File Access by Non-Browser Process
Detects unauthorized access to browser credential and sensitive configuration files (e.g., Login Data, cookies, key4.db) by processes that are not legitimate web browsers. The rule specifically accounts for known GIFTEDCROOK browser-stealing behavior by excluding legitimate browser subprocesses like utility, crashpad, or gpu processes.
Sigma
