Remcos RAT Browser Credential Harvest and Wipe via Injected Process
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Microsoft Sentinel (KQL)
