Remcos RAT Browser Cookie and Login Wipe on Startup
This rule detects when processes other than standard web browsers (Firefox, Chrome, Edge, IE) delete sensitive browser files such as 'cookies.sqlite', 'logins.json', 'Login Data', or 'Cookies'. This behavior is indicative of credential wiping or anti-forensics activity by malware, such as the Remcos RAT, attempting to clear evidence of browser activity.
Splunk (SPL)
