BQTLock/IronWorm Browser Credential Store & Wallet File Access (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects unauthorized attempts by processes other than standard web browsers to access credential-related files, including browser login databases, Firefox key files, and known cryptocurrency wallet data files. These activities are indicative of credential harvesting or theft attempts by malicious software.