Non-browser process reading Chrome/Edge/Opera/Firefox data and OpenVPN configs
Detects a single non-browser process that touches, copies, or stages files from multiple browser profile stores along with OpenVPN configuration files within a short timeframe, which is indicative of credential harvesting or session hijacking activity.
Microsoft Sentinel (KQL)
