AmnesiaStealer-style extension sweep across user folders by single process
Detects a filtered document sweep of Desktop, Documents, and Downloads by sensitive file extensions (including wallet and key files) performed by a single non-standard process, matching AmnesiaStealer's document harvesting routine.
Microsoft Sentinel (KQL)
