GIFTEDCROOK Browser Credential Theft - Chromium and Firefox Access

Ibrahim Saud@tektrix

•updated Jun 29, 2026•1•0•1

This rule detects non-browser processes attempting to access sensitive local files associated with common web browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox). Specifically, it monitors for file events involving login databases, cookies, and key storage files by processes other than legitimate browser executables, which is a common technique used by credential-stealing malware.