Pass-ta-key recon stage - something other than Chrome reading its own passkey vault
This rule detects unauthorized access to the Google Chrome LevelDB sync data files. These files contain sensitive information, including synced passwords, and are often targeted by credential-stealing malware. The rule excludes known legitimate Chrome processes to minimize noise, alerting when an unknown or suspicious process interacts with this specific directory structure.
Microsoft Sentinel (KQL)
