Browser credential/cookie/autofill file access on macOS (T1555.003)

Duo Tech@duotech

•updated Jul 14, 2026•1•0•2

This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.