| elastic |
Multiple Credential Access by VS Code or Cursor IDE Descendant |
production |
2026-10-26 |
| splunk |
Non Firefox Process Access Firefox Profile Dir |
production |
2026-10-06 |
| splunk |
Possible Browser Pass View Parameter |
deprecated |
2026-10-01 |
| elastic |
Keychain Password Retrieval via Command Line |
production |
2026-09-18 |
| elastic |
Browser Process Spawned from an Unusual Parent |
production |
2026-09-18 |
| elastic |
Suspicious Web Browser Sensitive File Access |
production |
2026-09-18 |
| splunk |
Non Chrome Process Accessing Chrome Default Dir |
production |
2026-08-14 |
| splunk |
Windows Credentials from Password Stores Chrome Copied in TEMP Dir |
production |
2026-06-25 |
| splunk |
Windows Credentials from Web Browsers Saved in TEMP Folder |
production |
2026-05-13 |
| sigma |
Suspicious File Access to Browser Credential Storage |
experimental |
2025-05-22 |
| sigma |
Potential Browser Data Stealing |
test |
2025-03-19 |
| sigma |
Access To Browser Credential Files By Uncommon Applications - Security |
test |
2024-10-21 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
PUA - WebBrowserPassView Execution |
test |
2023-02-14 |
| sigma |
SQLite Chromium Profile Data DB Access |
test |
2023-01-19 |
| sigma |
Access to Browser Login Data |
test |
2022-01-30 |