BabylonRAT Non-Browser Process Accessing Chrome/Firefox Credential Stores

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

This rule detects non-browser processes attempting to access sensitive web browser credential files, such as 'Login Data', 'logins.json', and 'key4.db'. Such activity is highly characteristic of credential-stealing malware (including BabylonRAT) attempting to exfiltrate stored passwords or session data from Google Chrome or Mozilla Firefox profiles.