GIFTEDCROOK Stealer: Browser Credential Store and KeePass/VPN File Access

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•1

This rule detects processes other than standard browsers (Chrome, Edge, Firefox, Opera) or authorized password managers (KeePass) accessing sensitive files such as browser credential stores, cookies, local state configuration files, KeePass databases (.kdbx), or VPN configuration files (.ovpn). The rule identifies suspicious activity by monitoring for access patterns that indicate potential credential theft or exfiltration.