Remcos RAT Browser Credential Harvesting and Cookie Store Deletion
This rule detects potential unauthorized access to web browser data files (such as logins, cookies, and history databases) or specific registry modifications indicative of browser hijacking or credential theft. It monitors for processes other than known web browsers accessing sensitive browser configuration files or creating registry keys in HKCU that might be used for persistence or browser configuration manipulation.
CQL
