BraZetsu Malware Framework - Evasive Browser Credential Harvesting via shutil.copyfile
This detection identifies processes that exhibit behavior consistent with browser credential and session data harvesting from Chromium-based browsers. Specifically, it looks for command lines containing the Python function shutil.copyfile() used to copy sensitive browser SQLite databases, including Login Data, Cookies, and History, from Google Chrome, Microsoft Edge, Brave, Opera, Vivaldi, Chromium user profiles.
Microsoft Sentinel (KQL)
