CastleStealer Browser Credential Store Access and Outbound HTTP Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects unauthorized processes attempting to access sensitive web browser files (such as Login Data, Cookies, and Web Data) which store credentials, sessions, and history. It monitors file access events specifically targeting Chrome, Edge, and Firefox profiles, while excluding expected legitimate browser process names.