BusySnake Stealer DPAPI/NSS browser master key decryption via Python
Detects Python scripts or processes accessing browser 'Local State' files and subsequently invoking decryption routines like DPAPI's CryptUnprotectData or NSS's PK11SDR_Decrypt. This behavior is indicative of credential theft activity where malware, such as BusySnake Stealer, attempts to decrypt stored browser credentials for exfiltration.
Microsoft Sentinel (KQL)
