Browser profile artifacts staged into hidden BackupFiles directory
Detects access or creation of sensitive browser-related files such as cookies, login data, and preferences within identified backup directories for Google Chrome and Microsoft Edge. This activity is often associated with credential theft or data staging for later exfiltration.
Microsoft Sentinel (KQL)
