StegoAd Extension Cookie and Credential Exfiltration to Known C2 Domains
This rule monitors web browser processes (msedge.exe, chrome.exe) for two distinct behaviors: performing network connections to known command and control (C2) or exfiltration domains, and accessing sensitive browser files such as cookies, login data, or web data files.
Splunk (SPL)
