StealC-style access to browser Login Data/Cookies stores followed by POST
This rule detects potential credential theft by monitoring for file access (creation, modification, or renaming) to common web browser sensitive files (Login Data or Cookies) followed by an outbound network connection from the same process within a 10-minute window. This behavior often indicates an adversary attempting to exfiltrate browser-stored credentials or session cookies.
Microsoft Sentinel (KQL)
