TA4922 Silver Fox: Browser Credential Store + DPAPI Access by Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects instances where non-browser or system maintenance processes attempt to access browser credential storage files, such as 'Login Data', 'key4.db', or 'logins.json'. The rule uses a self-join to correlate access to these sensitive files with access to the Windows DPAPI protection directories, often used to decrypt these credentials.