Non-browser process harvesting browser credential/cookie stores (SectopRAT)
Detects unauthorized processes, excluding standard web browsers, accessing sensitive browser files such as Login Data, Cookies, Web Data, and Local State. This activity is indicative of credential harvesting malware attempting to steal authentication cookies, saved passwords, or browser profiles.
Sigma
