TA4922 Browser Credential Store File Access by Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized processes attempting to access browser-stored credential files (Chrome, Edge, and Firefox) such as 'Login Data', 'Cookies', 'Local State', and 'logins.json'. The rule filters known browser processes and common password manager applications to reduce noise from legitimate software that manages or accesses these files.