Millenium RAT Browser Credential and Cookie Theft via Non-Browser Process
Detects unauthorized processes attempting to access sensitive browser credential files (Login Data and Cookies) for Chrome, Edge, and Firefox. The rule applies risk scoring based on whether the accessing process is located in suspicious directories (e.g., Temp, Downloads) or if specific indicators associated with the Millenium RAT are present.
Splunk (SPL)
