Non-browser process reading browser Login Data/Cookies SQLite databases
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
Microsoft Sentinel (KQL)
