GIFTEDCROOK Chromium and Firefox Browser Credential File Access
Detects unauthorized access to sensitive browser files, such as login databases, cookies, and encryption keys (e.g., key4.db, Login Data), from Chromium and Firefox-based browsers by processes other than the browsers themselves. The rule requires multiple distinct credential files to be accessed to minimize false positives.
YARA-L
