Staged browser credential/cookie files written to output\Default (passwords.json / cookies.json)
Detects file access events targeting sensitive browser files, specifically 'passwords.json' and 'cookies.json', located within the standard Chrome/browser application data directories. These files often contain stored credentials and session cookies, and unauthorized access is a common precursor to credential theft.
Microsoft Sentinel (KQL)
