CrashStealer collection of cryptocurrency wallet data (Exodus, Electrum, MetaMask)

Duo Tech@duotech

•updated Jul 14, 2026•0•0•3

This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.