GIFTEDCROOK Browser Credential Theft and Staging Artifact Detection
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Splunk (SPL)
