• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Lumma Stealer Browser File Access Detection

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Robert Fly@robertfly
    •updated Jun 26, 2025•8•2•95

    Identifies suspicious access to sensitive browser files by processes commonly used by Lumma Stealer, expanding coverage to include more browsers based on observed configurations.

    Microsoft Sentinel (KQL)

    Tags

    T1555.003 - Credentials from Web BrowsersS1213 - Lumma StealerT1059.010 - AutoHotKey & AutoITT1059.001 - PowerShellTA0006 - Credential AccessTA0002 - ExecutionFile AccessCredential AccessWindowsWindows Defender Atp

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?