Non-browser process accessing multiple browser credential, cookie and wallet
Detects non-browser processes accessing multiple sensitive browser credential/cookie files or cryptocurrency wallet files within a 24-hour window, which is a common indicator of credential theft or information stealer activity.
Splunk (SPL)
