TA4922 Chromium Credential Store Access by Non-Browser Process
This rule detects unauthorized read access to Chromium-based browser sensitive files (Login Data, Cookies, Web Data) by processes other than known browser executables. This behavior is indicative of credential theft or session hijacking, often observed in malware such as Atlas RAT, ValleyRAT, and SilentRunLoader.
YARA-L
