Detecting Infostealers: Credential, Cookie and Wallet Theft

Infostealers like Atomic Stealer, RedLine, Lumma and Vidar harvest browser credentials and cookies, system secrets and crypto wallets — feeding account takeover and the session-token theft behind many breaches. This pack covers detecting the theft: unexpected processes reading credential stores, LSASS, the Keychain and wallet files.

Signals at a Glance

Credential-Store Access

The defining behaviour is a non-browser process opening browser credential databases. Alert on reads of Chromium/Firefox Login Data and Cookies files by anything other than the browser:

title: Non-Browser Access to Browser Credential Store
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '\User Data\Default\Login Data'
            - '\User Data\Default\Network\Cookies'
    filter:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
    condition: selection and not filter
level: high

LSASS, Keychain & Wallets

• Alert on processes opening a handle to lsass.exe (Sysmon 10) from non-security tooling, and on known credential-dumping access masks.
• On macOS, alert on osascript presenting password dialogs and on reads of login.keychain-db by unexpected processes (the Atomic Stealer pattern).
• Monitor access to crypto-wallet application directories and seed/keystore files, and wallet browser-extension storage.
• The highest-fidelity signal is a single process reading many secret stores in quick succession, then creating an archive and connecting out — the full steal-and-send sequence.