UAC-0226 GIFTEDCROOK Browser Credential File Access by Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•10

Detects unauthorized processes attempting to access, modify, or create web browser data files such as 'Login Data' (credentials), 'Cookies', and 'Local State'. This rule identifies potential credential theft activity where non-browser processes interact with sensitive browser storage files, which is a common tactic used by info-stealing malware.