Suspicious File Access to Browser Credential Storage

frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore

Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.

2025-05-22 00:00:00

None

a1dfd976-4852-41d4-9507-dc6590a3ccd0

attack.credential-access attack.t1555.003 attack.discovery attack.t1217

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5429 from @swachchhanda000 - Katz stealer malware

2025-05-26