Bulk Credential and Wallet Data Theft via File Access to Telegram tdata, Browser Stores, and Wallet Directories
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Microsoft Sentinel (KQL)
