Stealer access to cryptocurrency wallet.dat or keystore files
This rule detects file creation, renaming, or modification events targeting files associated with cryptocurrency wallets, such as wallet.dat or files containing the string 'keystore'. Accessing these files is a common technique used by malware or malicious actors to steal cryptocurrency credentials and private keys.
Microsoft Sentinel (KQL)
