Non-Browser Process Accessing Chromium Login Data/Local State or Firefox Credential Stores

Ibrahim Saud@tektrix

•updated Jul 3, 2026•1•0•10

Detects unauthorized processes attempting to access sensitive browser credential files ('Login Data', 'Local State', 'key4.db', 'logins.json') which are typically associated with stored passwords and profile data. The rule specifically excludes common web browsers (Chrome, Edge, Firefox, Brave, Opera) to reduce noise from legitimate browser operations.