UAC-0226 GIFTEDCROOK: Non-Firefox Process Accessing Firefox Credential Files

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

This rule detects non-Mozilla processes that systematically access sensitive Firefox browser files such as logins.json, key3.db, key4.db, and cookies.sqlite. Repeated access by processes not associated with the Mozilla Corporation or the Firefox browser suite is indicative of credential harvesting attempts by malicious software.