Discord token theft via access to Discord/browser Local Storage leveldb files
Detects file activity (creation, modification, copying, or renaming) within the 'leveldb' directories of popular web browsers (Chrome, Edge, Brave, Opera) and Discord applications by processes other than the legitimate application executables. This behavior is highly indicative of credential theft or data staging, often associated with malware attempting to extract browser session cookies, local storage databases, or stored credentials.
Microsoft Sentinel (KQL)
