StealC Browser Credential and Crypto Wallet Automated Collection
This rule detects unauthorized attempts by non-browser processes to access sensitive browser-related files (Login Data, Cookies, Web Data, etc.) or interact with browser processes to extract secrets. It monitors for Sysmon Event IDs 10 (ProcessAccess), 11 (FileCreate), 7 (ImageLoad), and 1 (ProcessCreate) where a suspicious process (often located in temporary or user profile directories) attempts to read or interact with known browser credential storage paths.
Splunk (SPL)
